21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 94:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Riskware Sample b6faad807c27… — Score 78/100 — Hybrid Analysis","description":"Malicious verdict for sample b6faad807c27…. Malware family: Riskware. Threat score 78/100. 5/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","keywords":["Malicious","Riskware","malware analysis","sandbox report","threat intelligence","b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.Malware-gen.7360.1737","applicationCategory":["compressed","innosetup"],"identifier":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","additionalType":"Malicious sample"},"threatScore":78,"malwareFamily":"Riskware","antivirusDetections":{"malicious":5,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd2ZmYAAAAAAAAAZmZmZmZ4iIj3cAAAAAAAAGaIiP//////+HAAAAAAAAAG////iIiIiIhwAAAAAAAABo+I+IiIiIiIcAAAAAAAAAaI+PiIiIiIiGAAAAAAAAAHaIj4iIiIiIhgAAAAAAAAAGj/+IiIiIiIYAAAAAAAAABo//iIiIiIiGAAAAAAAAAAZ4iPiIiIj/9gAAAAAAAAAGaPj///////YAAAAAAAAABmiI////+Ij2AAAAAAAAAAZ4//iIiIiI9gAAAAAAAAAGdv//iTeIiIYAAAAAAAAABnaHf4eYM3iHcAAAAAAAAAZ3cieIj/iZh3AAAAAAAAAGeGiI/z/3O5dwAAAAAAAABnhv//+IibuzMAAAAAAAAAZ4eP//iZu7u5kAAAAAAAAGeIf///ebu7u5kAAAAAAABniG////ibu7u5kAAAAAAAZ4h4iIiHebu7u5kAAAAAAGeIh3d3iIebu7uZAAAAAABnd3d3d3d2ObuzkAAAAAAAZmZmZmZmZwmTmZAAAAAAAAAAAAAAAAAAmZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////AP/8AAB//AAAf/4AAH/+AAB//gAAf/4AAH//AAB//wAAf/8AAH//AAB//wAAf/8AAH//AAB//wAAP/8AAD//AAA//wAAP/8AAB//AAAP/wAAB/8AAAP/AAAD/wAAB/8AAgf///8P////////////////w==23:T9f1,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp")24:Ta8b,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\SECURITEINFO.COM.WIN32.MALWARE-GEN.7360.1737.EXE.LOCAL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-F9RJ4.TMP" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\SECURITEINFO.COM.WIN32.MALWARE-GEN.7360.1737.TMP.LOCAL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-6E1P4.TMP" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-6E1P4.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp.Local\" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\EDENA SRL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\PROGRAM_FILES_X86_EDENA_SRL_MININTERNO.NET_MINISTERO_ITERNO_2024_578FD3F4A685AFF7.CDF-MS" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\IS-EMSM1.TMP" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\IS-7E6GQ.TMP" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\IS-1CGA1.TMP" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp"25:T6fa,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007148.00000000.132802.00401000.00000020.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000000.141726.063B0000.00000004.mdmp")26:T4d9,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007360.00000000.141726.063B0000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")27:T6b2,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007280.00000002.136716.72EF1000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")28:T7c4,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "is-D7NRE.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "is-D7NRE.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "is-D7NRE.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "is-D7NRE.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "is-D7NRE.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "is-D7NRE.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "is-D7NRE.tmp" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "is-D7NRE.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "is-D7NRE.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "is-D7NRE.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "is-D7NRE.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "is-GBLD8.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "is-GBLD8.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "is-GBLD8.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "is-GBLD8.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "is-GBLD8.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "is-GBLD8.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "is-GBLD8.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "is-GBLD8.tmp"29:T542,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS")2a:T437,Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "76711734,5784,104,,GetKeyState,user32.dll,"252:06:04.660",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005820.00000002.78904.002E0000.00000004.mdmp") Found reference to API "26745986,5784,104,,GetKeyState,user32.dll,"252:07:30.008",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005820.00000003.84368.002E0000.00000004.mdmp")2b:Tb74,file/memory contains long string with (Indicator: "aes"; File: "is-719ST.tmp") file/memory contains long string with (Indicator: "aes"; File: "is-F61EM.tmp") file/memory contains long string with (Indicator: "rijndael"; File: "is-F61EM.tmp") file/memory contains long string with (Indicator: "aes"; File: "is-1R1QT.tmp") file/memory contains long string with (Indicator: "3des"; File: "is-1R1QT.tmp") file/memory contains long string with (Indicator: "ecdsa"; File: "is-1R1QT.tmp") file/memory contains long string with (Indicator: "aes"; File: "is-41714.tmp") file/memory contains long string with (Indicator: "base64"; File: "is-41714.tmp") file/memory contains long string with (Indicator: "aes"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "base64"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "diffie-hellman"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "ecdsa"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "base64"; File: "is-1F6P0.tmp") file/memory contains long string with (Indicator: "aes"; File: "is-5E27O.tmp") file/memory contains long string with (Indicator: "ecdsa"; File: "is-5E27O.tmp") Found string "NSSBase64_DecodeBuffer_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64Encoder_Destroy_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64Encoder_Create_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64Decoder_Update_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64Decoder_Destroy_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64_EncodeItem_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64Encoder_Update_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "NSSBase64Decoder_Create_Util" (Indicator: "base64"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found string "aeSd)" (Indicator: "aes"; Source: "00000000-00007360.00000001.143647.08A60000.00000004.mdmp")2c:Tcf9,Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CopySid" (Indicator: "CopySid"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp")2d:T666,Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: is-EMSM1.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: is-EMSM1.tmp] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: is-EMSM1.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-EMSM1.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: is-EMSM1.tmp]2e:T4d7,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "PR_CreateFileMap" (Indicator: "CreateFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp")2f:T730,Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" (Indicator: "RegDeleteValue"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00007280.00000002.136716.72EF1000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00007280.00000002.136716.72EF1000.00000020.mdmp")30:Tabd,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")31:T436,Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp")32:T676,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")33:T528,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")34:T5f3,Potential IP "2.0.0.0" found in string "mscorlib,2.0.0.0,,b77a5c561934e089,x86" Potential IP "2.0.0.0" found in string "System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Xml,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Data,2.0.0.0,,b77a5c561934e089,x86" Potential IP "2.0.0.0" found in string "System.EnterpriseServices,2.0.0.0,,b03f5f7f11d50a3a,x86" Potential IP "8.0.0.0" found in string "Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Transactions,2.0.0.0,,b77a5c561934e089,x86" "51.52.0.0" "2.0.0.0" "192.168.0.2" Potential IP "2.0.0.0" found in string "ystem.Configuration,2.0.0.0,,b03f5f7f11d50a3a" "4.0.0.0" "1.0.0.0" "11.1.12.0"35:T565,RegCloseKey OpenProcessToken RegOpenKeyExA GetSystemInfo GetFileAttributesA VirtualProtect GetVersionExA GetModuleFileNameA GetFileSize LockResource CreateDirectoryA DeleteFileA GetCommandLineA GetProcAddress GetModuleHandleA WriteFile LoadLibraryA CreateProcessA Sleep CreateFileA FindResourceA VirtualAlloc RegDeleteKeyA GetUserNameA RegCreateKeyExA RegDeleteValueA RegEnumKeyExA GetDriveTypeA GetLogicalDrives DeviceIoControl CopyFileA LoadLibraryExA CreateThread GetSystemDirectoryA TerminateProcess GetTickCount OpenProcess FindFirstFileA GetComputerNameA FindNextFileA WNetOpenEnumA ShellExecuteExA ShellExecuteA GetCursorPos GetLastActivePopup SetWindowsHookExA FindWindowA GetWindowThreadProcessId GetTempPathA UnhandledExceptionFilter GetStartupInfoA GetClipboardData EnumPrintersA GetModuleFileNameW GetTempFileNameA GetStartupInfoW LoadLibraryW ExitThread GetModuleHandleW IsDebuggerPresent CreateFileW GetDriveTypeW FindFirstFileW GetFileAttributesW CreateDirectoryW DeleteFileW FindNextFileW GetCommandLineW CreateProcessW GetTempPathW SetSecurityDescriptorDacl OutputDebugStringA OpenFileMappingA LoadLibraryExW GetThreadContext MapViewOfFile CreateFileMappingA accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto RegCreateKeyA GetSystemDirectoryW36:T81d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "PR_LoadLibrary" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "PORT_LoadLibraryFromOrigin" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "PR_LoadLibraryWithFlags" (Indicator: "LoadLibrary"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")37:T9c0,"is-D7NRE.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-GBLD8.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-1CGA1.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-OQGIA.tmp" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-9L9CJ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-SKNHO.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-6HN0B.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-EN6JB.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-QG48B.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-LFH1M.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-6B3FL.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-F59M3.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-DQ038.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-8OUT7.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-DEVLP.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-4LB1F.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-UN5RQ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT38:T672,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-HEEP8.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-1CGA1.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-OQGIA.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-EMSM1.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-SKNHO.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-DS9AC.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-4F3HR.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-QEMVC.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-9K06Q.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-8OUT7.tmp]39:T123a,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%TEMP%\is-F9RJ4.tmp\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] "is-S1NS0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-S1NS0.tmp] "is-7E6GQ.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp] "is-D7NRE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-D7NRE.tmp] "is-K6V14.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-K6V14.tmp] "is-IBL3F.tmp" has type "Zip archive data at least v2.0 to extract compression method=store" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-IBL3F.tmp] "is-G42MV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-G42MV.tmp] "is-HEEP8.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-HEEP8.tmp] "is-GBLD8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GBLD8.tmp] "is-1CGA1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp] "is-OQGIA.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-OQGIA.tmp] "is-7ULT6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7ULT6.tmp] "is-EMSM1.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp] "is-KV097.tmp" has type "Zip archive data at least v2.0 to extract compression method=store" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-KV097.tmp] "is-9L9CJ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-9L9CJ.tmp] "is-SKNHO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-SKNHO.tmp] "is-DS9AC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DS9AC.tmp] "is-4UN1E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4UN1E.tmp] "is-4F3HR.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4F3HR.tmp] "is-I1QCK.tmp" has type "ASCII text" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\dictionaries\is-I1QCK.tmp] "is-QEMVC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-QEMVC.tmp] "is-6HN0B.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6HN0B.tmp] "is-S6JLK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-S6JLK.tmp] "is-EN6JB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-EN6JB.tmp] "is-LMRFP.tmp" has type "ASCII text" - Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-LMRFP.tmp]3a:T5ff,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES Encryption3b:T7b5,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Benvenuti nel programma di installazione di Mininterno.net Ministero Iterno 2024" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Mininterno.net Ministero Iterno 2024 sar" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "&Avanti >" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Annulla" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Selezione processi addizionali" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Quali processi aggiuntivi si vogliono avviare?" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Selezionare i processi aggiuntivi che verranno eseguiti durante l'installazione di Mininterno.net Ministero Iterno 2024, poi preme" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "< &Indietro" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Pronto per l'installazione" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Il programma di installazione" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Inst&alla" - (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetWindowTextW" with parameter "Premere Installa per continuare con l'installazione, o Indietro per rivedere o modificare le impostazioni." - (UID: 00000000-00007280)3c:Ta18,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")3d:T7907,"temp.bin" has type "Unicode text UTF-8 (with BOM) text with very long lines (486) with CRLF line terminators"- Location: [%TEMP%\2931a361-671f-4eb8-8eb6-b11de00a236a\temp.bin]- [targetUID: 00000000-00007360] "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-F9RJ4.tmp\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp]- [targetUID: 00000000-00007280] "Mininterno.net Ministero Iterno 2024.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Sat Jul 13 07:32:06 2024 mtime=Sat Jul 13 07:32:08 2024 atime=Thu Jun 13 00:40:36 2024 length=5420664 window=hide"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Mininterno Ministero Interno 2024\Mininterno.net Ministero Iterno 2024.lnk]- [targetUID: 00000000-00007280] "Mininterno.net Ministero Iterno 2024.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Sat Jul 13 07:32:06 2024 mtime=Sat Jul 13 07:32:08 2024 atime=Thu Jun 13 00:40:36 2024 length=5420664 window=hide"- Location: [%PUBLIC%\Desktop\Mininterno.net Ministero Iterno 2024.lnk]- [targetUID: 00000000-00007280] "is-S1NS0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-S1NS0.tmp]- [targetUID: 00000000-00007280] "is-7E6GQ.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp]- [targetUID: 00000000-00007280] "is-D7NRE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-D7NRE.tmp]- [targetUID: 00000000-00007280] "is-K6V14.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-K6V14.tmp]- [targetUID: 00000000-00007280] "is-IBL3F.tmp" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-IBL3F.tmp]- [targetUID: 00000000-00007280] "is-G42MV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-G42MV.tmp]- [targetUID: 00000000-00007280] "is-HEEP8.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-HEEP8.tmp]- [targetUID: 00000000-00007280] "is-GBLD8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GBLD8.tmp]- [targetUID: 00000000-00007280] "is-1CGA1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp]- [targetUID: 00000000-00007280] "is-OQGIA.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-OQGIA.tmp]- [targetUID: 00000000-00007280] "is-7ULT6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7ULT6.tmp]- [targetUID: 00000000-00007280] "is-EMSM1.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp]- [targetUID: 00000000-00007280] "is-KV097.tmp" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-KV097.tmp]- [targetUID: 00000000-00007280] "is-9L9CJ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-9L9CJ.tmp]- [targetUID: 00000000-00007280] "is-SKNHO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-SKNHO.tmp]- [targetUID: 00000000-00007280] "is-DS9AC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DS9AC.tmp]- [targetUID: 00000000-00007280] "is-4UN1E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4UN1E.tmp]- [targetUID: 00000000-00007280] "is-4F3HR.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4F3HR.tmp]- [targetUID: 00000000-00007280] "is-I1QCK.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\dictionaries\is-I1QCK.tmp]- [targetUID: 00000000-00007280] "is-QEMVC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-QEMVC.tmp]- [targetUID: 00000000-00007280] "is-6HN0B.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6HN0B.tmp]- [targetUID: 00000000-00007280] "is-S6JLK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-S6JLK.tmp]- [targetUID: 00000000-00007280] "is-EN6JB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-EN6JB.tmp]- [targetUID: 00000000-00007280] "is-LMRFP.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-LMRFP.tmp]- [targetUID: 00000000-00007280] "is-IPF1Q.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-IPF1Q.tmp]- [targetUID: 00000000-00007280] "is-NUVS5.tmp" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-NUVS5.tmp]- [targetUID: 00000000-00007280] "is-QG48B.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-QG48B.tmp]- [targetUID: 00000000-00007280] "is-P4B6K.tmp" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-P4B6K.tmp]- [targetUID: 00000000-00007280] "is-719ST.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-719ST.tmp]- [targetUID: 00000000-00007280] "is-LFH1M.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LFH1M.tmp]- [targetUID: 00000000-00007280] "is-6B3FL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6B3FL.tmp]- [targetUID: 00000000-00007280] "is-LIB0D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-LIB0D.tmp]- [targetUID: 00000000-00007280] "is-UF49Q.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-UF49Q.tmp]- [targetUID: 00000000-00007280] "is-F61EM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-F61EM.tmp]- [targetUID: 00000000-00007280] "is-F59M3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-F59M3.tmp]- [targetUID: 00000000-00007280] "is-SBD43.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-SBD43.tmp]- [targetUID: 00000000-00007280] "is-1R1QT.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-1R1QT.tmp]- [targetUID: 00000000-00007280] "is-5DT2P.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-5DT2P.tmp]- [targetUID: 00000000-00007280] "is-QRUHJ.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-QRUHJ.tmp]- [targetUID: 00000000-00007280] "xpti.dat.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\xpti.dat.tmp]- [targetUID: 00000000-00007360] "is-HBVSO.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-HBVSO.tmp]- [targetUID: 00000000-00007280] "is-9K06Q.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-9K06Q.tmp]- [targetUID: 00000000-00007280] "is-41714.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-41714.tmp]- [targetUID: 00000000-00007280] "is-G955G.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-G955G.tmp]- [targetUID: 00000000-00007280] "is-CAUL4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-CAUL4.tmp]- [targetUID: 00000000-00007280] "is-J6HP4.tmp" has type "Unicode text UTF-8 text with very long lines (682) with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\greprefs\is-J6HP4.tmp]- [targetUID: 00000000-00007280] "is-DQ038.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-DQ038.tmp]- [targetUID: 00000000-00007280] "is-0AMEL.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-0AMEL.tmp]- [targetUID: 00000000-00007280] "is-GP1P6.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-GP1P6.tmp]- [targetUID: 00000000-00007280] "is-SJ98Q.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-SJ98Q.tmp]- [targetUID: 00000000-00007280] "is-OGVRG.tmp" has type "exported SGML document ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\dtd\is-OGVRG.tmp]- [targetUID: 00000000-00007280] "is-8OUT7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\plugins\is-8OUT7.tmp]- [targetUID: 00000000-00007280] "is-68Q3P.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-68Q3P.tmp]- [targetUID: 00000000-00007280] "is-E55B6.tmp" has type "ASCII text with very long lines (1880)"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts\is-E55B6.tmp]- [targetUID: 00000000-00007280] "is-C1FSR.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-C1FSR.tmp]- [targetUID: 00000000-00007280] "is-CHPAV.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-CHPAV.tmp]- [targetUID: 00000000-00007280] "is-SDUM6.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-SDUM6.tmp]- [targetUID: 00000000-00007280] "is-ALS03.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-ALS03.tmp]- [targetUID: 00000000-00007280] "is-F1JUB.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-F1JUB.tmp]- [targetUID: 00000000-00007280] "is-B1JN7.tmp" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-B1JN7.tmp]- [targetUID: 00000000-00007280] "is-HU0IU.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables\is-HU0IU.tmp]- [targetUID: 00000000-00007280] "is-LEN3M.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-LEN3M.tmp]- [targetUID: 00000000-00007280] "is-BRN5G.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-BRN5G.tmp]- [targetUID: 00000000-00007280] "is-EN2JR.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-EN2JR.tmp]- [targetUID: 00000000-00007280] "is-11677.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-11677.tmp]- [targetUID: 00000000-00007280] "is-FK8E2.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-FK8E2.tmp]- [targetUID: 00000000-00007280] "is-S82F2.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-S82F2.tmp]- [targetUID: 00000000-00007280] "is-EQFRU.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables\is-EQFRU.tmp]- [targetUID: 00000000-00007280] "is-H4T18.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-H4T18.tmp]- [targetUID: 00000000-00007280] "is-DEVLP.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DEVLP.tmp]- [targetUID: 00000000-00007280] "is-M299H.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-M299H.tmp]- [targetUID: 00000000-00007280] "is-KJ9R6.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-KJ9R6.tmp]- [targetUID: 00000000-00007280] "is-5F22J.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-5F22J.tmp]- [targetUID: 00000000-00007280] "is-PPSQP.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-PPSQP.tmp]- [targetUID: 00000000-00007280] "is-5I4ST.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-5I4ST.tmp]- [targetUID: 00000000-00007280] "is-LMA9Q.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-LMA9Q.tmp]- [targetUID: 00000000-00007280] "is-1F6P0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-1F6P0.tmp]- [targetUID: 00000000-00007280] "is-3R5H9.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-3R5H9.tmp]- [targetUID: 00000000-00007280] "is-4LB1F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4LB1F.tmp]- [targetUID: 00000000-00007280] "is-EG87F.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-EG87F.tmp]- [targetUID: 00000000-00007280] "is-CN4UT.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-CN4UT.tmp]- [targetUID: 00000000-00007280] "is-UN5RQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-UN5RQ.tmp]- [targetUID: 00000000-00007280] "is-83218.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-83218.tmp]- [targetUID: 00000000-00007280] "is-5QF84.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-5QF84.tmp]- [targetUID: 00000000-00007280] "is-TTGTU.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-TTGTU.tmp]- [targetUID: 00000000-00007280] "is-OM5DA.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-OM5DA.tmp]- [targetUID: 00000000-00007280] "is-12QIJ.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-12QIJ.tmp]- [targetUID: 00000000-00007280] "is-PD754.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-PD754.tmp]- [targetUID: 00000000-00007280] "is-NCFGR.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-NCFGR.tmp]- [targetUID: 00000000-00007280] "is-IO5QI.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-IO5QI.tmp]- [targetUID: 00000000-00007280] "is-PO606.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-PO606.tmp]- [targetUID: 00000000-00007280] "is-4H9UE.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-4H9UE.tmp]- [targetUID: 00000000-00007280] "is-GK3A5.tmp" has type "exported SGML document ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\dtd\is-GK3A5.tmp]- [targetUID: 00000000-00007280] "is-OT8A4.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-OT8A4.tmp]- [targetUID: 00000000-00007280] "is-8TL6F.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-8TL6F.tmp]- [targetUID: 00000000-00007280] "is-JATJ6.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\autoconfig\is-JATJ6.tmp]- [targetUID: 00000000-00007280] "is-F2BGD.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-F2BGD.tmp]- [targetUID: 00000000-00007280] "is-CBS36.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-CBS36.tmp]- [targetUID: 00000000-00007280] "is-GCU4O.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts\is-GCU4O.tmp]- [targetUID: 00000000-00007280] "is-PGLV2.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-PGLV2.tmp]- [targetUID: 00000000-00007280] "is-CJH4A.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-CJH4A.tmp]- [targetUID: 00000000-00007280] "is-SIL6H.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-SIL6H.tmp]- [targetUID: 00000000-00007280] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\is-6E1P4.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007280] "is-V2HFB.tmp" has type "Java archive data (JAR)"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-V2HFB.tmp]- [targetUID: 00000000-00007280] "is-KK2H1.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-KK2H1.tmp]- [targetUID: 00000000-00007280] "is-AOV0K.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-AOV0K.tmp]- [targetUID: 00000000-00007280] "is-4G431.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts\is-4G431.tmp]- [targetUID: 00000000-00007280] "is-BEPU4.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-BEPU4.tmp]- [targetUID: 00000000-00007280] "is-ERNB7.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-ERNB7.tmp]- [targetUID: 00000000-00007280] "is-T2VPR.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-T2VPR.tmp]- [targetUID: 00000000-00007280] "is-8P1HS.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables\is-8P1HS.tmp]- [targetUID: 00000000-00007280] "is-AKMQ7.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts\is-AKMQ7.tmp]- [targetUID: 00000000-00007280] "is-7BUGL.tmp" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\pref\is-7BUGL.tmp]- [targetUID: 00000000-00007280] "is-51QUK.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts\is-51QUK.tmp]- [targetUID: 00000000-00007280] "is-5E27O.tmp" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\greprefs\is-5E27O.tmp]- [targetUID: 00000000-00007280] "is-IP0UM.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables\is-IP0UM.tmp]- [targetUID: 00000000-00007280] "is-A2NB2.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-A2NB2.tmp]- [targetUID: 00000000-00007280] "is-6GGK7.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-6GGK7.tmp]- [targetUID: 00000000-00007280] "is-CNTFH.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-CNTFH.tmp]- [targetUID: 00000000-00007280] "is-J7DKC.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-J7DKC.tmp]- [targetUID: 00000000-00007280] "is-AN5UL.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-AN5UL.tmp]- [targetUID: 00000000-00007280] "is-DT74C.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\dictionaries\is-DT74C.tmp]- [targetUID: 00000000-00007280] "is-N840Q.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-N840Q.tmp]- [targetUID: 00000000-00007280] "is-DA4AH.tmp" has type "assembler source ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-DA4AH.tmp]- [targetUID: 00000000-00007280] "is-MTB9B.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts\is-MTB9B.tmp]- [targetUID: 00000000-00007280] "is-RROSH.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules\is-RROSH.tmp]- [targetUID: 00000000-00007280] "is-PFQTM.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables\is-PFQTM.tmp]- [targetUID: 00000000-00007280] "is-GCKFN.tmp" has type "POSIX shell script ASCII text executable"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-GCKFN.tmp]- [targetUID: 00000000-00007280] "is-53PBI.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-53PBI.tmp]- [targetUID: 00000000-00007280] "is-UI35Q.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-UI35Q.tmp]- [targetUID: 00000000-00007280] "is-BS2L0.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables\is-BS2L0.tmp]- [targetUID: 00000000-00007280] "is-87NES.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-87NES.tmp]- [targetUID: 00000000-00007280] "is-VD2HK.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components\is-VD2HK.tmp]- [targetUID: 00000000-00007280] "is-6A80I.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile\chrome\is-6A80I.tmp]- [targetUID: 00000000-00007280] "is-S0566.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-S0566.tmp]- [targetUID: 00000000-00007280] "is-0701J.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile\US\chrome\is-0701J.tmp]- [targetUID: 00000000-00007280] "is-DOOPQ.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-DOOPQ.tmp]- [targetUID: 00000000-00007280] "is-FFQ8G.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-FFQ8G.tmp]- [targetUID: 00000000-00007280] "is-NA6T9.tmp" has type "XML 1.0 document ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile\US\is-NA6T9.tmp]- [targetUID: 00000000-00007280] "is-L9GS0.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-L9GS0.tmp]- [targetUID: 00000000-00007280] "is-6KGS7.tmp" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-6KGS7.tmp]- [targetUID: 00000000-00007280] "is-HT52K.tmp" has type "HTML document ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\is-HT52K.tmp]- [targetUID: 00000000-00007280] "is-TRGVG.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-TRGVG.tmp]- [targetUID: 00000000-00007280] "is-0S50U.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\autoconfig\is-0S50U.tmp]- [targetUID: 00000000-00007280] "is-ER625.tmp" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\greprefs\is-ER625.tmp]- [targetUID: 00000000-00007280] "is-L7AG2.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome\is-L7AG2.tmp]- [targetUID: 00000000-00007280] "mi2024_spec" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Mininterno\Global\settings\mi2024_spec]- [targetUID: 00000000-00007360] "datami2024fa.db.st" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Mininterno\envmi2024fa\datami2024fa.db.st]- [targetUID: 00000000-00007360] "is-2CPI1.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-2CPI1.tmp]- [targetUID: 00000000-00007280] "statmi2024fa.db.ve" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Mininterno\envmi2024fa\statmi2024fa.db.ve]- [targetUID: 00000000-00007360] "datami2024fa.db.vr" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Mininterno\envmi2024fa\datami2024fa.db.vr]- [targetUID: 00000000-00007360]3e:T4ad,Found GetProcAddress() and LoadLibraryA() in an import section (Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737) Found GetProcAddress() and LoadLibraryA() in an import section (Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-HEEP8.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-EMSM1.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-SKNHO.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-DS9AC.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-4F3HR.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-QEMVC.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-EN6JB.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-719ST.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-LIB0D.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-9K06Q.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-8OUT7.tmp)3f:T65b,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp")40:T4c3,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" was detected as "Borland Delphi 4.0" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" was detected as "Borland Delphi 3.0" "is-D7NRE.tmp" was detected as "Microsoft visual C# / Basic .NET" "is-GBLD8.tmp" was detected as "Microsoft visual C# v7.0 / Basic .NET" "is-1CGA1.tmp" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-OQGIA.tmp" was detected as "VC8 -> Microsoft Corporation" "is-EMSM1.tmp" was detected as "Borland Delphi 3.0" "is-DS9AC.tmp" was detected as "VC8 -> Microsoft Corporation" "is-4F3HR.tmp" was detected as "VC8 -> Microsoft Corporation" "is-QEMVC.tmp" was detected as "Microsoft visual C++ v7.0" "is-6HN0B.tmp" was detected as "Microsoft visual C# v7.0 / Basic .NET" "is-QG48B.tmp" was detected as "Microsoft visual C# v7.0 / Basic .NET" "is-LFH1M.tmp" was detected as "Microsoft visual C# v7.0 / Basic .NET" "is-6B3FL.tmp" was detected as "Microsoft visual C# / Basic .NET" "is-F59M3.tmp" was detected as "Microsoft visual C# v7.0 / Basic .NET" "is-9K06Q.tmp" was detected as "Armadillo v1.xx - v2.xx" "is-DQ038.tmp" was detected as "Microsoft visual C# v7.0 / Basic .NET" "_setup64.tmp" was detected as "Morphine v1.2 (DLL)"41:Tec4,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\unins000.dat" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-QG48B.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-K6V14.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-DQ038.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GBLD8.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-D7NRE.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6B3FL.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-G42MV.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-9K06Q.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-KM2E6.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GSVCD.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LFH1M.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-52M3E.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6HN0B.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-F59M3.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7ULT6.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LL53S.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-S6JLK.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-TRGVG.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4HI76.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-719ST.tmp" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" touched file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DEVLP.tmp"42:Te2a,"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007280.00000000.132876.004A2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007280.00000000.132876.004A2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007280.00000000.132876.004A2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00007280.00000000.132876.004A2000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007280.00000000.132876.02D70000.00000004.mdmp 00000000-00007280.00000001.134794.02D70000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00007280.00000000.132876.02D70000.00000004.mdmp 00000000-00007280.00000001.134794.02D70000.00000004.mdmp 00000000-00007280.00000002.136716.02D70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00007280.00000002.136716.72EF1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00007280.00000002.136716.72EF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00007280.00000002.136716.72EF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00007280.00000002.136716.72EF1000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007360.00000000.141726.02FA0000.00000004.mdmp43:Te94,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" queries volume information of "C:\" at 00000000-00007280-00000C15-1195812015 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" queries volume information of "C:\" at 00000000-00007280-00000C15-1195992954 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_gdf_res.dll" at 00000000-00007360-00000C15-1230789575 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_gdf_res.dll" at 00000000-00007360-00000C15-1230789822 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.dll" at 00000000-00007360-00000C15-1230989527 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.dll" at 00000000-00007360-00000C15-1230989837 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Utils.v11.1.dll" at 00000000-00007360-00000C15-1231047114 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Utils.v11.1.dll" at 00000000-00007360-00000C15-1231047420 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.dll" at 00000000-00007360-00000C15-1231144135 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.dll" at 00000000-00007360-00000C15-1231144422 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007360-00000C15-1232255929 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007360-00000C15-1232256154 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\System.Data.SQLite.dll" at 00000000-00007360-00000C15-1252044609 "mininterno_mi2024.exe" queries volume information of "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\System.Data.SQLite.dll" at 00000000-00007360-00000C15-1252044853 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007360-00000C15-1252152247 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007360-00000C15-1252152561 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll" at 00000000-00007360-00000C15-1252397396 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll" at 00000000-00007360-00000C15-1252397648 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll" at 00000000-00007360-00000C15-1252765267 "mininterno_mi2024.exe" queries volume information of "C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll" at 00000000-00007360-00000C15-125276554344:T573,Observed unmanaged function "DrawMenuBar" in "is-D7NRE.tmp" Observed unmanaged function "DestroyMenu" in "is-D7NRE.tmp" Observed unmanaged function "GetSystemMenu" in "is-D7NRE.tmp" Observed unmanaged function "SetWindowTheme" in "is-D7NRE.tmp" Observed unmanaged function "NotifyWinEvent" in "is-D7NRE.tmp" Observed unmanaged function "LoadLibrary" in "is-D7NRE.tmp" Observed unmanaged function "FreeLibrary" in "is-D7NRE.tmp" Observed unmanaged function "InvalidateRgn" in "is-D7NRE.tmp" Observed unmanaged function "SetLayeredWindowAttributes" in "is-D7NRE.tmp" Observed unmanaged function "GetDC" in "is-D7NRE.tmp" Observed unmanaged function "UpdateLayeredWindow" in "is-D7NRE.tmp" Observed unmanaged function "ShowWindow" in "is-D7NRE.tmp" Observed unmanaged function "SetWindowPos" in "is-D7NRE.tmp" Observed unmanaged function "SendMessage" in "is-D7NRE.tmp" Observed unmanaged function "GetCurrentThreadId" in "is-D7NRE.tmp" Observed unmanaged function "SetWindowsHookEx" in "is-D7NRE.tmp" Observed unmanaged function "CallNextHookEx" in "is-D7NRE.tmp" Observed unmanaged function "UnhookWindowsHookEx" in "is-D7NRE.tmp" Observed unmanaged function "SetWindowLong" in "is-D7NRE.tmp" Observed unmanaged function "GetWindowLong" in "is-D7NRE.tmp" Observed unmanaged function "CallWindowProc" in "is-D7NRE.tmp" Observed unmanaged function "SetBkMode" in "is-D7NRE.tmp"45:T463,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "2606799390,3592,3136,,CreateProcessA,kernel32.dll,"00:34:31.171",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00007148.00000000.132802.036D0000.00000004.mdmp, 00000000-00007148.00000002.136643.036D0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp")46:T82f,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "mininterno_mi2024.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")47:T276b,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-F9RJ4.tmp\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp]- [targetUID: 00000000-00007280] "is-S1NS0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-S1NS0.tmp]- [targetUID: 00000000-00007280] "is-7E6GQ.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp]- [targetUID: 00000000-00007280] "is-D7NRE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-D7NRE.tmp]- [targetUID: 00000000-00007280] "is-K6V14.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-K6V14.tmp]- [targetUID: 00000000-00007280] "is-G42MV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-G42MV.tmp]- [targetUID: 00000000-00007280] "is-HEEP8.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-HEEP8.tmp]- [targetUID: 00000000-00007280] "is-GBLD8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GBLD8.tmp]- [targetUID: 00000000-00007280] "is-1CGA1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp]- [targetUID: 00000000-00007280] "is-OQGIA.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-OQGIA.tmp]- [targetUID: 00000000-00007280] "is-7ULT6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7ULT6.tmp]- [targetUID: 00000000-00007280] "is-EMSM1.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp]- [targetUID: 00000000-00007280] "is-9L9CJ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-9L9CJ.tmp]- [targetUID: 00000000-00007280] "is-SKNHO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-SKNHO.tmp]- [targetUID: 00000000-00007280] "is-DS9AC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DS9AC.tmp]- [targetUID: 00000000-00007280] "is-4UN1E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4UN1E.tmp]- [targetUID: 00000000-00007280] "is-4F3HR.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4F3HR.tmp]- [targetUID: 00000000-00007280] "is-QEMVC.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-QEMVC.tmp]- [targetUID: 00000000-00007280] "is-6HN0B.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6HN0B.tmp]- [targetUID: 00000000-00007280] "is-S6JLK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-S6JLK.tmp]- [targetUID: 00000000-00007280] "is-EN6JB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-EN6JB.tmp]- [targetUID: 00000000-00007280] "is-IPF1Q.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-IPF1Q.tmp]- [targetUID: 00000000-00007280] "is-QG48B.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-QG48B.tmp]- [targetUID: 00000000-00007280] "is-719ST.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-719ST.tmp]- [targetUID: 00000000-00007280] "is-LFH1M.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LFH1M.tmp]- [targetUID: 00000000-00007280] "is-6B3FL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6B3FL.tmp]- [targetUID: 00000000-00007280] "is-LIB0D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-LIB0D.tmp]- [targetUID: 00000000-00007280] "is-UF49Q.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-UF49Q.tmp]- [targetUID: 00000000-00007280] "is-F61EM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-F61EM.tmp]- [targetUID: 00000000-00007280] "is-F59M3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-F59M3.tmp]- [targetUID: 00000000-00007280] "is-1R1QT.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-1R1QT.tmp]- [targetUID: 00000000-00007280] "is-9K06Q.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-9K06Q.tmp]- [targetUID: 00000000-00007280] "is-41714.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-41714.tmp]- [targetUID: 00000000-00007280] "is-G955G.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-G955G.tmp]- [targetUID: 00000000-00007280] "is-CAUL4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-CAUL4.tmp]- [targetUID: 00000000-00007280] "is-DQ038.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-DQ038.tmp]- [targetUID: 00000000-00007280] "is-8OUT7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\plugins\is-8OUT7.tmp]- [targetUID: 00000000-00007280] "is-LEN3M.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-LEN3M.tmp]- [targetUID: 00000000-00007280] "is-FK8E2.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-FK8E2.tmp]- [targetUID: 00000000-00007280] "is-DEVLP.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DEVLP.tmp]- [targetUID: 00000000-00007280] "is-1F6P0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-1F6P0.tmp]- [targetUID: 00000000-00007280] "is-4LB1F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4LB1F.tmp]- [targetUID: 00000000-00007280] "is-UN5RQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-UN5RQ.tmp]- [targetUID: 00000000-00007280] "is-83218.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-83218.tmp]- [targetUID: 00000000-00007280] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\is-6E1P4.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007280] "is-GCKFN.tmp" has type "POSIX shell script ASCII text executable"- Location: [%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-GCKFN.tmp]- [targetUID: 00000000-00007280]48:T72d,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002608.00000001.83949.00781000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002608.00000001.83949.00781000.00000020.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00005820.00000000.75056.004A2000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00005856.00000002.78832.0040B000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005856.00000003.84358.00401000.00000020.mdmp")49:T4ef,file/memory contains long string with (Indicator: "RC2"; File: "is-F61EM.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-F61EM.tmp") file/memory contains long string with (Indicator: "SHA512"; File: "is-F61EM.tmp") file/memory contains long string with (Indicator: "RC2"; File: "is-1R1QT.tmp") file/memory contains long string with (Indicator: "RC2"; File: "is-41714.tmp") file/memory contains long string with (Indicator: "SHA512"; File: "is-41714.tmp") file/memory contains long string with (Indicator: "Oid"; File: "is-G955G.tmp") file/memory contains long string with (Indicator: "HMAC"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "RC2"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "SHA384"; File: "is-CAUL4.tmp") file/memory contains long string with (Indicator: "SHA512"; File: "is-CAUL4.tmp") Found reference to "SEC_GetSignatureAlgorithmOidTag" (Indicator: "Oid"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to "HASH_GetHashTypeByOidTag" (Indicator: "Oid"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to "HASH_GetHashObjectByOidTag" (Indicator: "Oid"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737")4a:T52e,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005820-00000C2C-177623181") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005820.00000000.75056.004A2000.00000002.mdmp, 00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005820.00000000.75056.004A2000.00000002.mdmp, 00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp")4b:Tc20,Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;" (Indicator: "sendmessage"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;" (Indicator: "postmessage"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp")4c:T10ef,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")4d:T149a,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.00401000.00000020.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp")4e:T220e,Observed string: "Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");const Ci = Components.interfaces;const Cc = Components.classes;function nowInSeconds() return Date.now() / 1000;function LOG(aMsg) { //aMsg = ("*** WIFI GEO: " + aMsg); //Cc["@mozilla.org/consoleservice;1"].getService(Ci.nsIConsoleService).logStringMessage(aMsg);function getAccessTokenForURL(url) // check to see if we have an access token: var accessToken = ""; try { var prefService = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch); var accessTokenPrefName = "geo.wifi.access_token." + url; accessToken = prefService.getCharPref(accessTokenPrefName); // check to see if it has expired var accessTokenDate = prefService.getIntPref(accessTokenPrefName + ".time"); var accessTokenInterval = 1209600; /* seconds in 2 weeks */ try { accessTokenInterval = prefService.getIntPref("geo.wifi.access_token.recycle_interval"); } catch (e) {} if (nowInSeconds() - accessTokenDate > accessTokenInterval) accessToken = ""; } catch (e) { accessToken = ""; LOG("Error: "+ e); } return accessToken;function WifiGeoCoordsObject(lat, lon, acc) { this.latitude = lat; this.longitude = lon; this.accuracy = acc;WifiGeoCoordsObject.prototype = { QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMGeoPositionCoords, Ci.nsIClassInfo]), getInterfaces: function(countRef) { var interfaces = [Ci.nsIDOMGeoPositionCoords, Ci.nsIClassInfo, Ci.nsISupports]; countRef.value = interfaces.length; return interfaces; }, getHelperForLanguage: function(language) null, contractID: "", classDescription: "wifi geo position coords object", classID: null, implementationLanguage: Ci.nsIProgrammingLanguage.JAVASCRIPT, flags: Ci.nsIClassInfo.DOM_OBJECT, latitude: 0, longitude: 0, accuracy: 0, altitude: 0, altitudeAccuracy: 0, heading: 0, speed: 0,function WifiGeoPositionObject(lat, lon, acc) { this.coords = new WifiGeoCoordsObject(lat, lon, acc); this.timestamp = Date.now();WifiGeoPositionObject.prototype = { QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMGeoPosition, Ci.nsIClassInfo]), // Class Info is required to be able to pass objects back into the DOM. getInterfaces: function(countRef) { var interfaces = [Ci.nsIDOMGeoPosition, Ci.nsIClassInfo, Ci.nsISupports]; countRef.value = interfaces.length; return interfaces; }, getHelperForLanguage: function(language) null, contractID: "", classDescription: "wifi geo location position object", classID: null, implementationLanguage: Ci.nsIProgrammingLanguage.JAVASCRIPT, flags: Ci.nsIClassInfo.DOM_OBJECT, coords: null, timestamp: 0,function WifiGeoPositionProvider() {};WifiGeoPositionProvider.prototype = { classDescription: "A component that returns a geolocation based on WIFI", classID: Components.ID("{77DA64D3-7458-4920-9491-86CC9914F904}"), contractID: "@mozilla.org/geolocation/provider;1", QueryInterface: XPCOMUtils.generateQI([Ci.nsIGeolocationProvider, Ci.nsIWifiListener, Ci.nsITimerCallback]), provider_url: null, wifi_service: null, timer: null, hasSeenWiFi: false, startup: function() { LOG("startup called"); var prefService = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch); this.provider_url = prefService.getCharPref("geo.wifi.uri"); LOG("provider url = " + this.provider_url); // if we don't see anything in 5 seconds, kick of one IP geo lookup. this.hasSeenWiFi = false; this.timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer); this.timer.initWithCallback(this, 5000, this.timer.TYPE_ONE_SHOT); }, isReady: function() { LOG("isReady called"); return true }, watch: function(c) { LOG("watch called"); if (!this.wifi_service) { this.wifi_service = Cc["@mozilla.org/wifi/monitor;1"].getService(Components.interfaces.nsIWifiMonitor); this.wifi_service.startWatching(this); } }, shutdown: function() { LOG("shutdown called"); if(this.wifi_service) this.wifi_service.stopWatching(this); this.wifi_service = null; if (this.timer != null) { this.timer.cancel(); this.timer = null; } // Although we aren't using cookies, we should err on the side of not // saving any access tokens if the user asked us not to save cookies or // has changed the lifetimePolicy. The access token in these cases is // used and valid for the life of this object (eg. between startup and // shutdown).e let prefBranch = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch); if (prefBranch.getIntPref("network.cookie.lifetimePolicy") != 0) prefBranch.deleteBranch("geo.wifi.access_token."); }, onChange: function(accessPoints) { LOG("onChange called"); this.hasSeenWiFi = true; var prefService = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch); // send our request to a wifi geolocation network provider: var xhr = Components.classes["@mozilla.org/xmlextras/xmlhttprequest;1"].createInstance(Ci.nsIXMLHttpRequest); // This is a background load xhr.mozBackgroundRequest = true; xhr.open("POST", this.provider_url, false); // set something so that we can strip cookies xhr.channel.loadFlags = Ci.nsIChannel.LOAD_ANONYMOUS; xhr.onerror = function(req) { LOG("onerror: " + req); }; xhr.onload = function (req) { LOG("service returned: " + req.target.responseText); // if we get a bad response, we will throw and never report a location var response = JSON.parse(req.target.responseText); // response looks something like: // {"location":{"latitude":51.5090332,"longitude":-0.1212726,"accuracy":150.0},"access_token":"2:jVhRZJ-j6PiRchH_:RGMrR0W1BiwdZs12"} // Check to see if we have a new access token var newAccessToken = response.access_token; if (newAccessToken != undefined) { var prefService = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch); var accessToken = ""; var accessTokenPrefName = "geo.wifi.access_token." + req.target.channel.URI.spec; try { accessToken = prefService.getCharPref(accessTokenPrefName); } catch (e) {} if (accessToken != newAccessToken) { // no match, lets cache LOG("New Access Token: " + newAccessToken + "\n" + accessTokenPrefName); prefService.setIntPref(accessTokenPrefName + ".time", nowInSeconds()); prefService.setCharPref(accessTokenPrefName, newAccessToken); } } var newLocation = new WifiGeoPositionObject(response.location.latitude, response.location.longitude, response.location.accuracy); var update = Cc["@mozilla.org/geolocation/service;1"].getService(Ci.nsIGeolocationUpdate); update.update(newLocation); }; var accessToken = getAccessTokenForURL(this.provider_url); var request = { version: "1.1.0",// request_address: true, }; if (accessToken != "") request.access_token = accessToken; if (accessPoints != null) { function filterBlankSSIDs(ap) ap.ssid != "" function deconstruct(ap) ({ mac_address: ap.mac, ssid: ap.ssid, signal_strength: ap.signal }) request.wifi_towers = accessPoints.filter(filterBlankSSIDs).map(deconstruct); } var jsonString = JSON.stringify(request); LOG("client sending: " + jsonString); xhr.send(jsonString); }, onError: function (code) { LOG("wifi error: " + code); }, notify: function (timer) { if (this.hasSeenWiFi == false) this.onChange(null); this.timer = null; },var components = [WifiGeoPositionProvider];function NSGetModule(compMgr, fileSpec) { return XPCOMUtils.generateModule(components);" (Indicator: ""shutdown ") in Source: is-4H9UE.tmp4f:T1314,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "CreateDirectoryA" with parameter %TEMP%\is-F9RJ4.tmp (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-6E1P4.tmp (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-6E1P4.tmp\_isetup (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\chrome (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\components (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\autoconfig (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\pref (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile\chrome (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile\US (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\defaults\profile\US\chrome (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\dictionaries (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\greprefs (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\modules (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\plugins (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\dtd (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\entityTables (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\fonts (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\res\html (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Mininterno Ministero Interno 2024 (UID: 00000000-00007280)50:T45a,Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp")51:T5b6,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" has an executable section named "CODE" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has an executable section named "CODE" "is-D7NRE.tmp" has an executable section named ".text" "is-HEEP8.tmp" has an executable section named "CODE" "is-GBLD8.tmp" has an executable section named ".text" "is-1CGA1.tmp" has an executable section named ".text" "is-OQGIA.tmp" has an executable section named ".text" "is-EMSM1.tmp" has an executable section named "CODE" "is-9L9CJ.tmp" has an executable section named ".text" "is-SKNHO.tmp" has an executable section named ".text" "is-DS9AC.tmp" has an executable section named ".text" "is-4UN1E.tmp" has an executable section named ".text" "is-4F3HR.tmp" has an executable section named ".text" "is-QEMVC.tmp" has an executable section named ".text" "is-6HN0B.tmp" has an executable section named ".text" "is-EN6JB.tmp" has an executable section named ".text" "is-IPF1Q.tmp" has an executable section named ".text" "is-QG48B.tmp" has an executable section named ".text" "is-719ST.tmp" has an executable section named ".text" "is-LFH1M.tmp" has an executable section named ".text" "is-6B3FL.tmp" has an executable section named ".text" "is-LIB0D.tmp" has an executable section named ".text" "is-UF49Q.tmp" has an executable section named ".text" "is-F61EM.tmp" has an executable section named ".text" "is-F59M3.tmp" has an executable section named ".text"52:T3b47,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74650000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74650000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74650000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "KERNEL32" at base 77590000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 734b0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "SHELL32.DLL" at base 75a30000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "COMCTL32.DLL" at base 73500000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "KERNEL32.DLL" at base 77590000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f50000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "NTDLL.DLL" at base 77a80000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743f0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74650000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74650000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74650000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "KERNEL32" at base 77590000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 734b0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f50000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "KERNEL32.DLL" at base 77590000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "OLEAUT32.DLL" at base 77960000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "RPCRT4.DLL" at base 75970000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75170000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75170000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 77660000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75540000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "UXTHEME.DLL" at base 73f50000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "SHELL32.DLL" at base 75a30000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "SHFOLDER.DLL" at base 73000000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "RSTRTMGR.DLL" at base 72fd0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75910000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "COMCTL32" at base 73500000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "COMCTL32.DLL" at base 73500000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75770000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75a30000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72ef0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 748d0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "NTDLL.DLL" at base 77a80000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "SSPICLI.DLL" at base 744a0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72810000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 7b0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74b90000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 739f0000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "CSCAPI.DLL" at base 73810000 "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743f0000 "mininterno_mi2024.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74650000 "mininterno_mi2024.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74650000 "mininterno_mi2024.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74650000 "mininterno_mi2024.exe" loaded module "KERNEL32" at base 77590000 "mininterno_mi2024.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 734b0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f50000 "mininterno_mi2024.exe" loaded module "MSCOREE.DLL" at base 72690000 "mininterno_mi2024.exe" loaded module "ADVAPI32.DLL" at base 75340000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73690000 "mininterno_mi2024.exe" loaded module "SHLWAPI.DLL" at base 75770000 "mininterno_mi2024.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75160000 "mininterno_mi2024.exe" loaded module "VERSION.DLL" at base 741c0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 72700000 "mininterno_mi2024.exe" loaded module "USER32.DLL" at base 75170000 "mininterno_mi2024.exe" loaded module "NTDLL" at base 77a80000 "mininterno_mi2024.exe" loaded module "SHELL32.DLL" at base 75a30000 "mininterno_mi2024.exe" loaded module "KERNEL32.DLL" at base 77590000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\7AA13700A6FCDCB57E6CB353E54D0AB9\MSCORLIB.NI.DLL" at base 711f0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "mininterno_mi2024.exe" loaded module "OLE32.DLL" at base 748d0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "mininterno_mi2024.exe" loaded module "OLEAUT32.DLL" at base 77960000 "mininterno_mi2024.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72ea0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75910000 "mininterno_mi2024.exe" loaded module "IMM32.DLL" at base 74830000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\SHFUSION.DLL" at base 735d0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\FUSION.DLL" at base 73530000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 73520000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\SHFUSRES.DLL" at base 73500000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 733d0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\61E9A201160F8BAED9F7E00A4969992E\SYSTEM.NI.DLL" at base 71ee0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\D6163E1C32EBA738E42523885580DC48\SYSTEM.DRAWING.NI.DLL" at base 73240000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\860A4E79ADBD2EB86ADE9317E1CD9D2A\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 70610000 "mininterno_mi2024.exe" loaded module "RPCRT4.DLL" at base 75970000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "mininterno_mi2024.exe" loaded module "PSAPI.DLL" at base 758f0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\MININTERNO_GDF_RES.DLL" at base 89a0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "mininterno_mi2024.exe" loaded module "UXTHEME.DLL" at base 73f50000 "mininterno_mi2024.exe" loaded module "GDI32.DLL" at base 772a0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\DEVEXPRESS.XTRAEDITORS.V11.1.DLL" at base a140000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\DEVEXPRESS.UTILS.V11.1.DLL" at base a320000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\VERSION.DLL" at base 0 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\DEVEXPRESS.DATA.V11.1.DLL" at base a9e0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\GDIPLUS.DLL" at base 0 "mininterno_mi2024.exe" loaded module "GDIPLUS.DLL" at base 741e0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 741e0000 "mininterno_mi2024.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74650000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\C7A2F551C65C81870E822E9E134513F9\SYSTEM.XML.NI.DLL" at base 700d0000 "mininterno_mi2024.exe" loaded module "COMCTL32.DLL" at base 6feb0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\A6E9B5EECB43BF90683528D0BC5EB166\SYSTEM.DATA.NI.DLL" at base 6f850000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f570000 "mininterno_mi2024.exe" loaded module "SHFOLDER.DLL" at base 72fb0000 "mininterno_mi2024.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75170000 "mininterno_mi2024.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75170000 "mininterno_mi2024.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 77660000 "mininterno_mi2024.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75540000 "mininterno_mi2024.exe" loaded module "WINDOWSCODECS.DLL" at base 71d40000 "mininterno_mi2024.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 748d0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\MOZCRT19.DLL" at base 6f120000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\NSPR4.DLL" at base 72f00000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\PLC4.DLL" at base 726f0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\PLDS4.DLL" at base 6f0e0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\NSSUTIL3.DLL" at base 6f0c0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\FREEBL3.DLL" at base 6f070000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\IA2MARSHAL.DLL" at base 6f060000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\JAVAXPCOMGLUE.DLL" at base 6f050000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\JS3250.DLL" at base 6ef80000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\NSS3.DLL" at base 6eee0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\NSSCKBI.DLL" at base 6ee80000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\NSSDBM3.DLL" at base 6ee60000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\SMIME3.DLL" at base 6ee40000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\SQLITE3.DLL" at base 6edc0000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\SOFTOKN3.DLL" at base 6ed90000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\SSL3.DLL" at base 6ed60000 "mininterno_mi2024.exe" loaded module "WS2_32.DLL" at base 76d70000 "mininterno_mi2024.exe" loaded module "DWMAPI.DLL" at base 73450000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\XUL.DLL" at base 6dc10000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\RUNTIME\XPCOM.DLL" at base 6ecb0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\XPCOM" at base 0 "mininterno_mi2024.exe" loaded module "XPCOM" at base 6ecb0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74b90000 "mininterno_mi2024.exe" loaded module "%PROGRAMFILES%\(X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\SYSTEM.DATA.SQLITE.DLL" at base d300000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\8DDCDCBD703020F2256EE42DCDCF717A\SYSTEM.TRANSACTIONS.NI.DLL" at base 6ec10000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ebc0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM.DESIGN\2.0.0.0__B03F5F7F11D50A3A\SYSTEM.DESIGN.DLL" at base e1b0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\ACCESSIBILITY\4DF45D236634B9581E073BDD4F3D3595\ACCESSIBILITY.NI.DLL" at base 6ebb0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\CD4B9B7E793D3FE3AD5C9542420992BE\SYSTEM.CONFIGURATION.NI.DLL" at base 6eab0000 "mininterno_mi2024.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.ENTERPRISESERVICES\2.0.0.0__B03F5F7F11D50A3A\SYSTEM.ENTERPRISESERVICES.DLL" at base d9d0000 "mininterno_mi2024.exe" loaded module "OLE32" at base 748d000053:T7fc,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp")54:Td2c,Found registry query API: "RegQueryValueExA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry query API: "RegOpenKeyExA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry query API: "RegOpenKeyEx" in file "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in file "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry query API: "RegEnumValueA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry query API: "RegQueryInfoKeyA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry query API: "RegEnumKeyExA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry query API: "RegQueryValueExW" in "00000000-00002608.00000001.83949.00781000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002608.00000001.83949.00781000.00000020.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005820.00000000.75056.004A2000.00000002.mdmp, 00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005820.00000000.75056.004A2000.00000002.mdmp, 00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00005820.00000000.75056.004A2000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005856.00000002.78832.0040B000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005856.00000002.78832.0040B000.00000004.mdmp"55:T588,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "procedure CreateMutex(const Name: String);" (Indicator: "CreateMutex"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")56:T16ba1,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteA (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00007280) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InitializeAssemblyFolder (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateAssemblyCache (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateApplicationContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCachePath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateInstallReferenceEnum (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RI8 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RI8_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_WI4 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_WI4_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_WI8 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_WI8_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindAtom (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindAtomW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AddAtom (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter AddAtomW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipStringFormatGetGenericTypographic (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCloneStringFormat (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetStringFormatFlags (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetStringFormatHotkeyPrefix (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetStringFormatAlign (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetStringFormatLineAlign (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetStringFormatTrimming (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateFromHWND (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteFontFamily (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteStringFormat (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetGenericFontFamilySansSerif (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetPageUnit (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateFont (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTextMetrics (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCharWidth (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCharWidthW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCharABCWidths (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCharABCWidthsW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetStringFormatFlags (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetStringFormatHotkeyPrefix (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetStringFormatTrimming (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetStringFormatAlign (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetViewportOrgEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetStringFormatLineAlign (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ExtTextOut (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreatePath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipAddPathArcI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipAddPathLineI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRectI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipFillPath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDrawPath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeletePath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageHorizontalResolution (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageVerticalResolution (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipBitmapSetResolution (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDrawImageI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRectI (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsThemePartDefinedW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeColorW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DrawThemeBackgroundW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ExtSelectClipRgn (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreateHatchBrush (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetClipRegion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_CStringContainerInit (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_CStringSetData (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_NewNativeLocalFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_CStringContainerFinish (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_InitXPCOM2 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_GetComponentManager (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter NS_GetComponentRegistrar (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_open_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_open_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_open_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_close_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_close_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_close_interop@4 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_errmsg_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_errmsg_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_errmsg_interop@8 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_busy_timeout (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_key (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptDeriveKey (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_prepare_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_prepare_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_prepare_interop@24 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_finalize_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_finalize_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_finalize_interop@4 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_bind_parameter_count (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_count (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_step (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_changes (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_reset_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_reset_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_reset_interop@4 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoGetDefaultContext (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidFinalize (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidFinalizeA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _DllBidFinalize@0 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidEntryPoint (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidEntryPointA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _DllBidEntryPoint@36 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidInitialize (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidInitializeA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _DllBidInitialize@0 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidCtlProc (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter DllBidCtlProcW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _DllBidCtlProc@24 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_decltype_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_decltype_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_column_decltype_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_type (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_text_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_text_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_column_text_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_name_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_name_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_column_name_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_libversion (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_int64 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_origin_name_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_origin_name_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_column_origin_name_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_table_name_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_table_name_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_column_table_name_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_database_name_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_database_name_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_column_database_name_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_table_column_metadata_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_table_column_metadata_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_table_column_metadata_interop@44 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_column_int (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_table_cursor (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_table_cursorA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_table_cursor@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_index_column_info_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_index_column_info_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_index_column_info_interop@32 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_bind_parameter_name_interop (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_bind_parameter_name_interopA (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter _sqlite3_bind_parameter_name_interop@12 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_bind_text (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipCreatePathGradientFromPath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetPathGradientWrapMode (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipSetPathGradientPresetBlend (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_bind_int64 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_bind_null (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter sqlite3_get_autocommit (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00007360)57:T4ba,"mininterno_mi2024.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\VERSION.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "mininterno_mi2024.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xpcom" - [base:0; Status:c0000135]58:T7bf,Found string "nspr4.dllplc4.dllplds4.dllsqlite3.dllnssutil3.dllsoftokn3.dllnss3.dllssl3.dllsmime3.dlljs3250.dllxul.dll" (Indicator: "softokn3.dll"; File: "is-TRGVG.tmp") Found string "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00007280-00000C50-1190943400") Found string "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00007280-00000C50-1191215869") Found string "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00007280-00000C50-1191884160") Found string "C:\...\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00007280-00000455-266592435656") Found string "C:\...\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00007280-00000455-267189430740") Found string "C:\...\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00007280-00000455-268862327258") Found string "{app}\runtime\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found string "{app}\runtime\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found string "{app}\runtime\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found string "ogram Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00007360.00000001.143647.0308A000.00000004.mdmp")59:T894,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")5a:T761,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "654379159" "cx": "16" "cy": "16"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "654379159" "cx": "52" "cy": "39"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "167840089" "cx": "52" "cy": "39"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "167840089" "cx": "16" "cy": "16"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "167840089" "cx": "32" "cy": "32"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "167840089" "cx": "75" "cy": "23"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "654379159" "cx": "75" "cy": "23"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "167840089" "cx": "396" "cy": "17"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "654379159" "cx": "17" "cy": "171"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "654379159" "cx": "396" "cy": "17"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "285279957" "cx": "17" "cy": "171"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "285279957" "cx": "396" "cy": "17"} "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "167840089" "cx": "17" "cy": "171"}5b:Tc5b,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" (Indicator: "RegGetValue"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")5c:Tef6,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: is-EMSM1.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: is-EMSM1.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-EMSM1.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: is-EMSM1.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: is-EMSM1.tmp] Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: is-UF49Q.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: is-UF49Q.tmp] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: is-UF49Q.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-UF49Q.tmp] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: is-UF49Q.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: is-UF49Q.tmp] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: is-UF49Q.tmp] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: is-UF49Q.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: is-UF49Q.tmp] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: is-UF49Q.tmp] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: is-UF49Q.tmp] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: is-UF49Q.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: _setup64.tmp]5d:T844,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")5e:T13de,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-6E1P4.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-6E1P4.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-52M3E.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 24576 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DEVLP.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 13824 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4LB1F.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 14848 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-1F6P0.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 11776 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-83218.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 39744 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-LEN3M.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" wrote 32794 bytes starting with PE header signature to file "C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-FK8E2.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5f:T18d7,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\unins000.exe" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_mi2024.exe" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\7z.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-QG48B.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.Compact.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-K6V14.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-DQ038.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.Linq.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GBLD8.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Printing.v11.1.Core.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-D7NRE.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Utils.v11.1.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6B3FL.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.Design.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-G42MV.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-9K06Q.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\edenadiffp32.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-KM2E6.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mi2024fa.qfi" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GSVCD.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mi2024fef.qfi" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LFH1M.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_gdf_res.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-52M3E.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\Mininterno_mi2024.exe" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6HN0B.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\PdfSharp.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-F59M3.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\SevenZipSharp.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7ULT6.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\System.Data.SQLite.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LL53S.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\zlibwapi.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-S6JLK.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\zxing.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-TRGVG.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\dependentlibs.list" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4HI76.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.chk" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-719ST.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DEVLP.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\IA2Marshal.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" renamed original file"C:\Program Files (x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-V2HFB.tmp" to "%PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\javaxpcom.jar"60:T522,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\SECURITEINFO.COM.WIN32.MALWARE-GEN.7360.1737.EXE.LOCAL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll"61:T428,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '4264896'}" (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4901352'}" (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4901368'}" (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4901384'}" (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4901480'}" (UID: 00000000-00007280) "mininterno_mi2024.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4350536'}" (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadResource with parameter {'hModule': '1934622720', 'hResInfo': '1934637600'}" (UID: 00000000-00007360)62:Tc7b,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-F9RJ4.TMP\SECURITEINFO.COM.WIN32.MALWARE-GEN.7360.1737.TMP"; Value: "") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\EDENA SRL\MININTERNO.NET MINISTERO ITERNO 2024\MININTERNO_MI2024.EXE"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: ""), "mininterno_mi2024.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")63:T648,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" has an writable section named "DATA" "SecuriteInfo.com.Win32.Malware-gen.7360.1737" has an writable section named "BSS" "SecuriteInfo.com.Win32.Malware-gen.7360.1737" has an writable section named ".idata" "SecuriteInfo.com.Win32.Malware-gen.7360.1737" has an writable section named ".tls" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has an writable section named "DATA" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has an writable section named "BSS" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has an writable section named ".idata" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has an writable section named ".tls" "is-HEEP8.tmp" has an writable section named "DATA" "is-HEEP8.tmp" has an writable section named "BSS" "is-HEEP8.tmp" has an writable section named ".idata" "is-HEEP8.tmp" has an writable section named ".tls" "is-1CGA1.tmp" has an writable section named ".data" "is-OQGIA.tmp" has an writable section named ".data" "is-EMSM1.tmp" has an writable section named "DATA" "is-EMSM1.tmp" has an writable section named "BSS" "is-EMSM1.tmp" has an writable section named ".idata" "is-EMSM1.tmp" has an writable section named ".tls" "is-9L9CJ.tmp" has an writable section named ".data" "is-SKNHO.tmp" has an writable section named ".data" "is-DS9AC.tmp" has an writable section named ".data" "is-4UN1E.tmp" has an writable section named ".data" "is-4F3HR.tmp" has an writable section named ".data" "is-QEMVC.tmp" has an writable section named ".data" "is-EN6JB.tmp" has an writable section named ".data"64:T1813,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")65:Td13,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "LockResource" (Indicator: "LockResource"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.00401000.00000020.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007360.00000000.141726.063B0000.00000004.mdmp, 00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp")66:T608,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-9K06Q.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-8OUT7.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007360-00000C26-1231941662") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")67:T441,WaitForSingleObject@KERNEL32.DLL at 00000000-00005820-4077-104-00458A44 Sleep@KERNEL32.DLL at 00000000-00005820-4077-689-0042EE18 MsgWaitForMultipleObjects at 00000000-00005820-4077-713-00458C1C SetTimer at 00000000-00005820-4077-2334-00424B2C MsgWaitForMultipleObjects at 00000000-00005820-4077-2705-00454F7C Sleep@KERNEL32.DLL at 00000000-00005820-4077-2710-00455674 MsgWaitForMultipleObjects at 00000000-00005820-4077-2744-00457FF8 Sleep@KERNEL32.DLL at 00000000-00005820-4077-2989-0046B478 MsgWaitForMultipleObjects at 00000000-00005820-4077-3010-00478000 MsgWaitForMultipleObjects at 00000000-00005820-4077-3072-0042EC74 MsgWaitForMultipleObjects at 00000000-00005820-4077-3095-00478898 Sleep@KERNEL32.DLL at 00000000-00005820-4077-3359-00492C54 WaitForSingleObject@KERNEL32.DLL at 00000000-00005820-4077-3390-00496A34 MsgWaitForMultipleObjects at 00000000-00005820-4077-3396-00497190 Sleep@KERNEL32.DLL at 00000000-00005820-4077-3403-0049756C MsgWaitForMultipleObjects at 00000000-00005820-4077-3410-00498910 Sleep@KERNEL32.DLL at 00000000-00005820-4077-4426-0047D12468:T90f,Found string "asks will be merged with the set of tasks that would have otherwise been selected by default./PASSWORD=passwordSpecifies the password to use.For more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" (Indicator: "password"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") file/memory contains long string with (Indicator: "password"; File: "is-S0566.tmp") file/memory contains long string with (Indicator: "password"; File: "is-DOOPQ.tmp") Found string "/PASSWORD=password" (Indicator: "password"; Source: "00000000-00007148.00000000.132802.00401000.00000020.mdmp") Found string "Specifies the password to use." (Indicator: "password"; Source: "00000000-00007148.00000000.132802.00401000.00000020.mdmp") Found string "La password inserita non" (Indicator: "password"; Source: "00000000-00007148.00000002.136643.05450000.00000004.mdmp") Found string "protetta da password." (Indicator: "password"; Source: "00000000-00007148.00000002.136643.05450000.00000004.mdmp") Found string "Inserire la password, poi premere Avanti per continuare. Le password sono sensibili alle maiuscole/minuscole." (Indicator: "password"; Source: "00000000-00007148.00000002.136643.05450000.00000004.mdmp") Found string "La password inserita non" (Indicator: "password"; Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found string "protetta da password." (Indicator: "password"; Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found string "Inserire la password, poi premere Avanti per continuare. Le password sono sensibili alle maiuscole/minuscole." (Indicator: "password"; Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found string "KGets or sets the password character displayed instead of actual characters." (Indicator: "password"; Source: "00000000-00007360.00000001.143647.0A142000.00000002.mdmp") Found string "qGets or sets whether password mode is active and the system password character is used to mask the editor's text." (Indicator: "password"; Source: "00000000-00007360.00000001.143647.0A142000.00000002.mdmp")69:T10b6,Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/smi/2" Heuristic match: "yy.tf" Heuristic match: "g0.se" Heuristic match: "o2.ad" Heuristic match: "u:.cl" Heuristic match: "|mi`.cv" Pattern match: "file.eof/error" Pattern match: "http://www.mozilla.org/mpl/copyright" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://www.winimage.com/zlibdll" Pattern match: "mozilla.org/preferences-service;1truehiddenclassidpluginurlcodebasepluginspageerror" Pattern match: "http://www.mozilla.org/mpl/" Pattern match: "http://www.mozilla.org/mpl/#" Pattern match: "http://www.mozilla.org/newlayout/xml/parsererror.xml;const" Pattern match: "mozilla.org/consoleservice;1].getservice(ci.nsiconsoleservice).logstringmessage(amsg);function" Pattern match: "mozilla.org/file/directory_service;1" Pattern match: "mozilla.org/toolkit/urlformatterservice;1" Pattern match: "mozilla.org/preferences-service;1" Pattern match: "mozilla.org/appshell/window-mediator;1" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" Pattern match: "http://www.mozilla.org/unix/customizing.html" Pattern match: "http://home.netscape.com/nc-rdf#" Pattern match: "http://hg.mozilla.org/releases/mozilla-1.9.1" Pattern match: "http://www.mininterno.net/" Heuristic match: "mininterno.net" Heuristic match: "minintemo.net" Heuristic match: "pathext=.co" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "font.name" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "%.gf" Heuristic match: "command.com" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Heuristic match: "sets or retrieves which panel is currently active in the pen input panel.wf" Heuristic match: "specifies the stroke or collection of strokes to remove from the given collection of strokes.ws" Heuristic match: "provides the best tradeoff between save-time and storage for the typical application.ws" Pattern match: "microsoft.net/framework/v2.0.50727/" Heuristic match: "soft.net" Heuristic match: "kvz.ar" Heuristic match: "$this.name" Heuristic match: ">columnlist.name" Heuristic match: ">fieldlist.name" Heuristic match: ">btadd.name" Heuristic match: ">btremove.name" Heuristic match: ">btndown.name" Heuristic match: ">btnup.name" Heuristic match: ">chbfieldlist.name" Heuristic match: ">groupcontrolcolumns.name" Heuristic match: ">horzsplitter.name" Heuristic match: ">pgmain.name" Heuristic match: ">pnlcontrol.name" Heuristic match: ">pnllist.name" Heuristic match: ">pnlproperty.name" Heuristic match: ">splmain.name" Heuristic match: ">buttoncancel.name" Heuristic match: ">descriptioncontrol.name" Heuristic match: ">expressionedit.name" Heuristic match: ">labelcontrol1.name" Heuristic match: ">labelcontrol3.name" Heuristic match: ">layoutitembutton10.name" Heuristic match: ">layoutitembutton11.name" Heuristic match: ">layoutitembutton12.name" Heuristic match: ">layoutitembutton13.name" Heuristic match: ">layoutitembutton14.name" Heuristic match: ">layoutitembutton15.name" Heuristic match: ">layoutitembutton2.name" Heuristic match: ">layoutitembutton3.name" Heuristic match: ">layoutitembutton4.name" Heuristic match: ">layoutitembutton5.name" Heuristic match: ">layoutitembutton6.name" Heuristic match: ">layoutitembutton7.name" Heuristic match: ">layoutitembutton9.name" Heuristic match: ">listofinputtypes.name" Heuristic match: ">btnapply.name" Heuristic match: ">btnfill.name" Heuristic match: ">btnsave.name" Heuristic match: ">btnxmlload.name" Heuristic match: ">chcolumnselector.name" Heuristic match: ">lbcaption.name" Heuristic match: ">lbxmltable.name" Heuristic match: ">pnlbottom.name" Heuristic match: ">pnldata.name" Heuristic match: ">pnlgrid.name" Heuristic match: ">pnlmain.name" Heuristic match: ">pnltop.name" Heuristic match: ">pnlxml.name"6a:T479,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")6b:T593,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002608.00000001.83949.00781000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp, 00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp, 00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005856.00000002.78832.0040B000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005856.00000002.78832.0040B000.00000004.mdmp")6c:T5f4,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007148.00000000.132802.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00007148.00000002.136643.0040B000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00007280.00000000.132876.004A2000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")6d:T9e5,Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "3708489916,7288,109,,GetWindowTextW,user32.dll,"00:34:32.781",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007280.00000000.132876.02D70000.00000004.mdmp, 00000000-00007280.00000001.134794.02D70000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found reference to API "115016241104,7288,109,,GetWindowTextW,user32.dll,"00:35:19.156",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007280.00000002.136716.02D70000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp")6e:T37a0,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter Rstrtmgr.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00007280) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\shfusion.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter Mscoree.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Fusion.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_gdf_res.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Utils.v11.1.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\VERSION.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\c7a2f551c65c81870e822e9e134513f9\System.Xml.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\a6e9b5eecb43bf90683528d0bc5eb166\System.Data.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\mozcrt19.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nspr4.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\plc4.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\plds4.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nssutil3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\IA2Marshal.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\javaxpcomglue.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\js3250.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nss3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nssckbi.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\nssdbm3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\smime3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\sqlite3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\softokn3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\ssl3.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\xul.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\xpcom.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xpcom (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter xpcom (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\System.Data.SQLite.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\8ddcdcbd703020f2256ee42dcdcf717a\System.Transactions.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\System.Data.SQLite.DLL (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\4df45d236634b9581e073bdd4f3d3595\Accessibility.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cd4b9b7e793d3fe3ad5c9542420992be\System.Configuration.ni.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll (UID: 00000000-00007360) "mininterno_mi2024.exe" called "LoadLibrary" with a parameter Ole32 (UID: 00000000-00007360)6f:T6d8,is-D7NRE.tmp has big resource with name: "$this.Name" size: "6439175" and abnormal entropy:"7.75778888801" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.about.jpg" size: "33754" and abnormal entropy:"7.99158901808" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.Images.trial.png" size: "26364" and abnormal entropy:"7.93455077932" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.Skins.Skins_Icons_16x16.png" size: "22332" and abnormal entropy:"7.98023929456" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.Skins.Skins_Icons_48x48.png" size: "112037" and abnormal entropy:"7.97905064945" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.caramel.blob" size: "201011" and abnormal entropy:"7.82476581735" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.imaginary.blob" size: "201406" and abnormal entropy:"7.82995597176" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.lilian.blob" size: "201735" and abnormal entropy:"7.83522473705" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.money twins.blob" size: "308153" and abnormal entropy:"7.89875564388" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.black.blob" size: "296387" and abnormal entropy:"7.89833982253" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.blue.blob" size: "292979" and abnormal entropy:"7.893582619" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.devexpress style.blob" size: "291682" and abnormal entropy:"7.90313655463" is-D7NRE.tmp has big resource with name: "DevExpress.Utils.SkinData.devexpress dark style.blob" size: "243614" and abnormal entropy:"7.79912579869"70:Tb22,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\NETMSG.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" trying to access non-existent file "C:\netmsg.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\MPR.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\VERSION.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\FLTLIB.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\NETMSG.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\netmsg.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\SHFOLDER.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\shfolder.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\shfolder.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\RSTRTMGR.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\Rstrtmgr.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\NCRYPT.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\ncrypt.dll" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\BCRYPT.DLL" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-F9RJ4.tmp\bcrypt.dll"71:T46ec,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x3c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x24], eax,call 0x4030dc,call 0x4042e8,call 0x40457c,call 0x404624,call 0x4065c8,call 0x408f38,call 0x4090a4,xor eax, eax,push ebp,push 0x40acc9,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x40ac92,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x40c014],call 0x409b78,call 0x409768," "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0xc,push ebx,push esi,push edi,call 0x403344,call 0x4056a0,call 0x40631c,call 0x4063c4,call 0x40994c,call 0x410764,call 0x4109cc,call 0x412928,call 0x419040,call 0x424f40,call 0x42f708,call 0x4309f4,call 0x44f744,call 0x44fc10,call 0x450414,call 0x4517f8,call 0x4531f0,call 0x4570b4," "is-D7NRE.tmp" file has an entrypoint instructions - "jmp dword ptr [0x11002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-HEEP8.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,mov ecx, 8,push 0,push 0,dec ecx,jne 0x542130,push ebx,push esi,push edi,mov eax, dword ptr [0x553b24],mov byte ptr [eax], 1,mov eax, 0x541ce0,call 0x406c74,xor eax, eax,push ebp,push 0x5424ee,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,call 0x541718,mov eax, dword ptr [0x5538b8],call 0x40363c,call 0x402bb8,fld qword ptr [0x557048],fcomp dword ptr [0x542500],fnstsw ax,sahf ,jbe 0x5421d4,call 0x40d240,fcomp qword ptr [0x557048],fnstsw ax," "is-GBLD8.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-1CGA1.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100cf968,call 0x100d1536,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100cf862,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10106760], eax,mov dword ptr [0x1010675c], ecx,mov dword ptr [0x10106758], edx,mov dword ptr [0x10106754], ebx,mov dword ptr [0x10106750], esi,mov dword ptr [0x1010674c], edi,mov word ptr [0x10106778], ss,mov word ptr [0x1010676c], cs," "is-OQGIA.tmp" file has an entrypoint instructions - "call 0x47b6f2,jmp 0x46ee13,int3 ,int3 ,mov ecx, dword ptr [esp + 0xc],push edi,test ecx, ecx,je 0x46f01f,push esi,push ebx,mov ebx, ecx,mov esi, dword ptr [esp + 0x14],test esi, 3,mov edi, dword ptr [esp + 0x10],jne 0x46efac,shr ecx, 2,jne 0x46f02f,jmp 0x46efd3,mov al, byte ptr [esi],add esi, 1,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,je 0x46efe6,test al, al,je 0x46efee,test esi, 3,jne 0x46efac,mov ebx, ecx,shr ecx, 2,jne 0x46f02f,and ebx, 3,je 0x46efe6,mov al, byte ptr [esi],add esi, 1," "is-EMSM1.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0xc,push ebx,push esi,push edi,call 0x403344,call 0x4056a0,call 0x40631c,call 0x4063c4,call 0x40994c,call 0x410764,call 0x4109cc,call 0x412928,call 0x419040,call 0x424f40,call 0x42f708,call 0x4309f4,call 0x44f744,call 0x44fc10,call 0x450414,call 0x4517f8,call 0x4531f0,call 0x4570b4," "is-9L9CJ.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x100b083f,call 0x100b0b60,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x100b06c0,add esp, 4,pop esi,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x100c2b20], eax,mov dword ptr [0x100c2b1c], ecx,mov dword ptr [0x100c2b18], edx,mov dword ptr [0x100c2b14], ebx,mov dword ptr [0x100c2b10], esi,mov dword ptr [0x100c2b0c], edi,mov word ptr [0x100c2b38], ss," "is-SKNHO.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x781323cf,call 0x7813fae0,mov eax, dword ptr [esp + 0x10],push eax,mov eax, esi,call 0x78131fa0,add esp, 4,pop esi,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push esi,push edi,xor esi, esi,mov edi, 0x781d6b18,lea esp, [esp],cmp dword ptr [esi*8 + 0x781d40d4], 1,jne 0x7813242d,mov dword ptr [esi*8 + 0x781d40d0], edi,mov eax, dword ptr [esi*8 + 0x781d40d0],push 0xfa0,push eax,add edi, 0x18," "is-DS9AC.tmp" file has an entrypoint instructions - "call 0x45b40f,jmp 0x450299,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,lea eax, [edx - 1],pop ebx,ret ,lea esp, [esp],lea esp, [esp],xor eax, eax,mov al, byte ptr [esp + 8],push ebx,mov ebx, eax,shl eax, 8,mov edx, dword ptr [esp + 8],test edx, 3,je 0x45049d,mov cl, byte ptr [edx],add edx, 1,cmp cl, bl,je 0x450460,test cl, cl,je 0x4504e6,test edx, 3,jne 0x450488,or ebx, eax,push edi,mov eax, ebx,shl ebx, 0x10,push esi,or ebx, eax,mov ecx, dword ptr [edx],mov edi, 0x7efefeff,mov eax, ecx,mov esi, edi," "is-4UN1E.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x1007b09f,call 0x1007b4f0,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x1007af20,add esp, 4,pop esi,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10095e60], eax,mov dword ptr [0x10095e5c], ecx,mov dword ptr [0x10095e58], edx,mov dword ptr [0x10095e54], ebx,mov dword ptr [0x10095e50], esi,mov dword ptr [0x10095e4c], edi,mov word ptr [0x10095e78], ss," "is-4F3HR.tmp" file has an entrypoint instructions - "call 0x45568f,jmp 0x44a51c,int3 ,int3 ,int3 ,int3 ,lea eax, [edx - 1],pop ebx,ret ,lea esp, [esp],lea esp, [esp],xor eax, eax,mov al, byte ptr [esp + 8],push ebx,mov ebx, eax,shl eax, 8,mov edx, dword ptr [esp + 8],test edx, 3,je 0x44a71d,mov cl, byte ptr [edx],add edx, 1,cmp cl, bl,je 0x44a6e0,test cl, cl,je 0x44a766,test edx, 3,jne 0x44a708,or ebx, eax,push edi,mov eax, ebx,shl ebx, 0x10,push esi,or ebx, eax,mov ecx, dword ptr [edx],mov edi, 0x7efefeff,mov eax, ecx,mov esi, edi,xor ecx, ebx," "is-QEMVC.tmp" file has an entrypoint instructions - "push 0x18,push 0x46da58,call 0x44a5a4,mov edi, 0x94,mov eax, edi,call 0x447e40,mov dword ptr [ebp - 0x18], esp,mov esi, esp,mov dword ptr [esi], edi,push esi,call dword ptr [0x46102c],mov ecx, dword ptr [esi + 0x10],mov dword ptr [0x48dca8], ecx,mov eax, dword ptr [esi + 4],mov dword ptr [0x48dcb4], eax,mov edx, dword ptr [esi + 8],mov dword ptr [0x48dcb8], edx,mov esi, dword ptr [esi + 0xc],and esi, 0x7fff,mov dword ptr [0x48dcac], esi,cmp ecx, 2,je 0x446889,or esi, 0x8000,mov dword ptr [0x48dcac], esi,shl eax, 8," "is-6HN0B.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-EN6JB.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x100622cf,call 0x100627e0,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x10062150,add esp, 4,pop esi,ret 0xc,push 0xc,push 0x1006ab90,call 0x10062890,and dword ptr [ebp - 4], 0,movapd xmm0, xmm1,mov dword ptr [ebp - 0x1c], 1,jmp 0x10062326,mov eax, dword ptr [ebp - 0x14],mov eax, dword ptr [eax],mov eax, dword ptr [eax],cmp eax, 0xc0000005,je 0x1006231b,cmp eax, 0xc000001d,je 0x1006231b,xor eax, eax,ret ,xor eax, eax,inc eax,ret ,mov esp, dword ptr [ebp - 0x18]," "is-IPF1Q.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x1000a65f,call 0x1000a9b0,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x1000a4e0,add esp, 4,pop esi,ret 0xc,jmp dword ptr [0x1000b064],jmp dword ptr [0x1000b068],jmp dword ptr [0x1000b06c],push 0x1004da6c,call 0x1000aa5e,pop ecx,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push -2,push 0x100481c0,push 0x1000a983," "is-QG48B.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-719ST.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x1002968f,call 0x10029ba0,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x10029510,add esp, 4,pop esi,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x1003b470], eax,mov dword ptr [0x1003b46c], ecx,mov dword ptr [0x1003b468], edx,mov dword ptr [0x1003b464], ebx,mov dword ptr [0x1003b460], esi,mov dword ptr [0x1003b45c], edi,mov word ptr [0x1003b488], ss," "is-LFH1M.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-6B3FL.tmp" file has an entrypoint instructions - "jmp dword ptr [0x11002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-LIB0D.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x18,mov dword ptr [ebp - 4], esi,mov esi, dword ptr [ebp + 0xc],mov dword ptr [ebp - 8], ebx,cmp esi, 1,je 0x6cb01070,mov dword ptr [esp + 4], esi,mov edx, dword ptr [ebp + 0x10],mov dword ptr [esp + 8], edx,mov edx, dword ptr [ebp + 8],mov dword ptr [esp], edx,call 0x6cb24e90,sub esp, 0xc,cmp esi, 1,mov ebx, eax,je 0x6cb01060,test esi, esi,jne 0x6cb01044,mov ecx, dword ptr [0x6cb2b000],test ecx, ecx,jne 0x6cb01052,xor ebx, ebx,mov eax, ebx,mov ebx, dword ptr [ebp - 8],mov esi, dword ptr [ebp - 4],mov esp, ebp,pop ebp,ret 0xc,call 0x6cb010b0,jmp 0x6cb01044,lea esi, [esi],test eax, eax,jne 0x6cb01034," "is-UF49Q.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x1001c8ff,call 0x1001cde0,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x1001c780,add esp, 4,pop esi,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x100263c0], eax,mov dword ptr [0x100263bc], ecx,mov dword ptr [0x100263b8], edx,mov dword ptr [0x100263b4], ebx,mov dword ptr [0x100263b0], esi,mov dword ptr [0x100263ac], edi,mov word ptr [0x100263d8], ss," "is-F61EM.tmp" file has an entrypoint instructions - "push esi,mov esi, dword ptr [esp + 0xc],cmp esi, 1,jne 0x1001b4af,call 0x1001b900,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],push eax,mov edx, esi,call 0x1001b330,add esp, 4,pop esi,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10022588], eax,mov dword ptr [0x10022584], ecx,mov dword ptr [0x10022580], edx,mov dword ptr [0x1002257c], ebx,mov dword ptr [0x10022578], esi,mov dword ptr [0x10022574], edi,mov word ptr [0x100225a0], ss," "is-F59M3.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"72:T812,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-D7NRE.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-HEEP8.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-GBLD8.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-1CGA1.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-OQGIA.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-EMSM1.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-9L9CJ.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-SKNHO.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-DS9AC.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-4UN1E.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-4F3HR.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-QEMVC.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-6HN0B.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-EN6JB.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-IPF1Q.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-QG48B.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-719ST.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-LFH1M.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-6B3FL.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-UF49Q.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-F61EM.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-F59M3.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-1R1QT.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE73:T1597,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" was detected as "Inno Setup Module" and name: "Installer" "SecuriteInfo.com.Win32.Malware-gen.7360.1737" was detected as "Borland Delphi" and name: "Compiler" "SecuriteInfo.com.Win32.Malware-gen.7360.1737" was detected as "Turbo Linker" and name: "Linker" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" was detected as "Inno Setup Module" and name: "Installer" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" was detected as "Borland Delphi" and name: "Compiler" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" was detected as "Turbo Linker" and name: "Linker" "is-D7NRE.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-D7NRE.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-D7NRE.tmp" was detected as "Turbo Linker" and name: "Linker" "is-HEEP8.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-HEEP8.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-HEEP8.tmp" was detected as "Turbo Linker" and name: "Linker" "is-GBLD8.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-GBLD8.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-GBLD8.tmp" was detected as "Turbo Linker" and name: "Linker" "is-1CGA1.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1CGA1.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-1CGA1.tmp" was detected as "Turbo Linker" and name: "Linker" "is-OQGIA.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-OQGIA.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-OQGIA.tmp" was detected as "Turbo Linker" and name: "Linker" "is-EMSM1.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-EMSM1.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-EMSM1.tmp" was detected as "Turbo Linker" and name: "Linker" "is-9L9CJ.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-9L9CJ.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-9L9CJ.tmp" was detected as "Turbo Linker" and name: "Linker" "is-SKNHO.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-SKNHO.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-SKNHO.tmp" was detected as "Turbo Linker" and name: "Linker" "is-DS9AC.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-DS9AC.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-DS9AC.tmp" was detected as "Turbo Linker" and name: "Linker" "is-4UN1E.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-4UN1E.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-4UN1E.tmp" was detected as "Turbo Linker" and name: "Linker" "is-4F3HR.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-4F3HR.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-4F3HR.tmp" was detected as "Turbo Linker" and name: "Linker" "is-QEMVC.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-QEMVC.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-QEMVC.tmp" was detected as "Turbo Linker" and name: "Linker" "is-6HN0B.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-6HN0B.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-6HN0B.tmp" was detected as "Turbo Linker" and name: "Linker" "is-EN6JB.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-EN6JB.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-EN6JB.tmp" was detected as "Turbo Linker" and name: "Linker" "is-IPF1Q.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-IPF1Q.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-IPF1Q.tmp" was detected as "Turbo Linker" and name: "Linker" "is-QG48B.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-QG48B.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-QG48B.tmp" was detected as "Turbo Linker" and name: "Linker" "is-719ST.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-719ST.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-719ST.tmp" was detected as "Turbo Linker" and name: "Linker" "is-LFH1M.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-LFH1M.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-LFH1M.tmp" was detected as "Turbo Linker" and name: "Linker" "is-6B3FL.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-6B3FL.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-6B3FL.tmp" was detected as "Turbo Linker" and name: "Linker" "is-LIB0D.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-LIB0D.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-LIB0D.tmp" was detected as "Turbo Linker" and name: "Linker" "is-UF49Q.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-UF49Q.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-UF49Q.tmp" was detected as "Turbo Linker" and name: "Linker" "is-F61EM.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-F61EM.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-F61EM.tmp" was detected as "Turbo Linker" and name: "Linker" "is-F59M3.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-F59M3.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-F59M3.tmp" was detected as "Turbo Linker" and name: "Linker"74:T8a9,"is-1CGA1.tmp" contains export function called "CreateObject" at ordinal 1 "is-1CGA1.tmp" contains export function called "GetHandlerProperty" at ordinal 3 "is-1CGA1.tmp" contains export function called "GetHandlerProperty2" at ordinal 2 "is-1CGA1.tmp" contains export function called "GetMethodProperty" at ordinal 4 "is-1CGA1.tmp" contains export function called "GetNumberOfFormats" at ordinal 5 "is-1CGA1.tmp" contains export function called "GetNumberOfMethods" at ordinal 6 "is-1CGA1.tmp" contains export function called "SetLargePageMode" at ordinal 7 "is-9L9CJ.tmp" contains export function called "?js_SetTraceableNativeFailed@@YAXPAUJSContext@@@Z" at ordinal 1 "is-9L9CJ.tmp" contains export function called "?js_obj_defineGetter@@YAHPAUJSContext@@IPAH@Z" at ordinal 2 "is-9L9CJ.tmp" contains export function called "?js_obj_defineSetter@@YAHPAUJSContext@@IPAH@Z" at ordinal 3 "is-9L9CJ.tmp" contains export function called "?resolving_MatchEntry@@YAHPAUJSDHashTable@@PBUJSDHashEntryHdr@@PBX@Z" at ordinal 4 "is-9L9CJ.tmp" contains export function called "@JS_DHashTableOperate@12" at ordinal 5 "is-9L9CJ.tmp" contains export function called "@js_CloseIterator@8" at ordinal 6 "is-9L9CJ.tmp" contains export function called "JS_AddArgumentFormatter" at ordinal 7 "is-9L9CJ.tmp" contains export function called "JS_AddExternalStringFinalizer" at ordinal 8 "is-9L9CJ.tmp" contains export function called "JS_AddNamedRoot" at ordinal 9 "is-9L9CJ.tmp" contains export function called "JS_AddNamedRootRT" at ordinal 10 "is-9L9CJ.tmp" contains export function called "JS_AddRoot" at ordinal 11 "is-9L9CJ.tmp" contains export function called "JS_AliasElement" at ordinal 12 "is-9L9CJ.tmp" contains export function called "JS_AliasProperty" at ordinal 13 "is-9L9CJ.tmp" contains export function called "JS_AlreadyHasOwnElement" at ordinal 14 "is-9L9CJ.tmp" contains export function called "JS_AlreadyHasOwnProperty" at ordinal 15 "is-9L9CJ.tmp" contains export function called "JS_AlreadyHasOwnPropertyById" at ordinal 16 "is-9L9CJ.tmp" contains export function called "JS_AlreadyHasOwnUCProperty" at ordinal 17 "is-9L9CJ.tmp" contains export function called "JS_ArenaAllocate" at ordinal 1875:T6e7,"SecuriteInfo.com.Win32.Malware-gen.7360.1737" has section name CODE with entropy "6.63176587695" "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" has section name CODE with entropy "6.59628714695" "is-D7NRE.tmp" has section name .text with entropy "7.49700133525" "is-HEEP8.tmp" has section name CODE with entropy "6.58231905673" "is-HEEP8.tmp" has section name .reloc with entropy "6.73798912488" "is-HEEP8.tmp" has section name .rsrc with entropy "7.38490923443" "is-1CGA1.tmp" has section name .text with entropy "6.54507654401" "is-OQGIA.tmp" has section name .text with entropy "6.62842027171" "is-EMSM1.tmp" has section name CODE with entropy "6.59628714695" "is-9L9CJ.tmp" has section name .text with entropy "6.5775845344" "is-9L9CJ.tmp" has section name .reloc with entropy "6.23689957713" "is-SKNHO.tmp" has section name .text with entropy "6.69855569625" "is-SKNHO.tmp" has section name .rdata with entropy "6.77133304245" "is-SKNHO.tmp" has section name .reloc with entropy "6.00419335599" "is-DS9AC.tmp" has section name .text with entropy "6.63157962186" "is-DS9AC.tmp" has section name .rdata with entropy "6.18855023703" "is-4UN1E.tmp" has section name .text with entropy "6.50356465771" "is-4F3HR.tmp" has section name .text with entropy "6.617663082" "is-4F3HR.tmp" has section name .rdata with entropy "6.14964282866" "is-QEMVC.tmp" has section name .text with entropy "6.58468074506" "is-EN6JB.tmp" has section name .text with entropy "6.61874931071" "is-EN6JB.tmp" has section name .rdata with entropy "6.10029302097" "is-EN6JB.tmp" has section name .reloc with entropy "6.39571278023" "is-IPF1Q.tmp" has section name .text with entropy "6.27141780166" "is-IPF1Q.tmp" has section name .rdata with entropy "7.0299418439"76:T4d2,Found system information discovery API: "GetSystemInfo" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005820.00000000.75056.004A2000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005820.00000000.75056.004A2000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005856.00000002.78832.0040B000.00000004.mdmp"77:T6d0,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp")78:T612,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter a5e90c83f6d4da01 & a511aed6bbd4da01 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 9ca26382f6d4da01 & 9cca04d6bbd4da01 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToSystemTime" (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 00da404e2abdda01 & 0002e2a1efbcda01 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 001f16de6b45cb01 & 0047b7313145cb01 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 008073bc9b5fd001 & 00a81410615fd001 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 00ada4bd9b5fd001 & 00d54511615fd001 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 00dad5be9b5fd001 & 00027712615fd001 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 0015ef0a1522cc01 & 003d905eda21cc01 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "FileTimeToLocalFileTime" with parameter 002f7b2cf9bcda01 & 00571c80bebcda01 (UID: 00000000-00007280)79:T6ed,"is-D7NRE.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-GBLD8.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-9L9CJ.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-SKNHO.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-4UN1E.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-6HN0B.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-EN6JB.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-IPF1Q.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-QG48B.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-719ST.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-LFH1M.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-6B3FL.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-UF49Q.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-F61EM.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-F59M3.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-1R1QT.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-41714.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-G955G.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-CAUL4.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-DQ038.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-8OUT7.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-DEVLP.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-1F6P0.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-4LB1F.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-UN5RQ.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"7a:T172f,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000214000fcf72f01482140004f214000f8a54000f8a54000030000008c0344056c03440520000000c522400028f82f01ee224000f5224000f8a540000300000014f82f010000000020f82f01b6254000dd314000f8a54000090400000b56400013564000f8a54000f8a540000010110100000000000000000000000040f82f01 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000214000a0f8af00fc21400003224000e8904900e8904900030000008c03fc046c03fc042000000079234000ccf8af00a2234000a9234000e890490003000000b8f8af0000000000c4f8af006a26400045344000e890490009040000678940006f894000e8904900e890490000d08300000000000000000000000000e4f8af00 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetVersionExA" with parameter 9400000006000000030000008025000002000000000a7a00da094300000000005cf8af007ec0002e000943000000000044f8af00b4f8af00f8f8af0050d45f777c5f2694feffffff1c2f5d77632b5d77b4f8af000000000004f9af0097094300b4f8af00576e6450726f63507472303034303030303030303030314337380000009049000000400000080127781c000000d08300 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetVersionExA" with parameter 9400000006000000030000008025000002000000000000008025000002000000000a7a00da094300000000005cf8af007ec0002e000943000000000044f8af00b4f8af00f8f8af0050d45f777c5f2694feffffff1c2f5d77632b5d77b4f8af000000000004f9af0097094300b4f8af00576e6450726f635074723030343030303030303030303143373800000090490000004000 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetVersionExA" with parameter 94000000060000000300000080250000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "GetVersionExA" with parameter 9c0000000600000003000000802500000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034755936e3d4e4f8af00d73e480000003475803f480001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00007280) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000770069006e007300780073005c007800380036005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e0039003300340038005f006e00 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000675a77fb48d0710800000004000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff240000000000000054e5cf000000000004000000000000000000000000000000000000000000000031175f7320f5c21858e5cf00270eae77ffffffff2400000054e5cf00 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000660069006c00650073002000280078003800360029005c006500640065006e0061002000730072006c005c006d0069006e0069006e007400650072006e006f002e006e006500740020006d0069006e00690073007400650072006f00200069007400650072006e006f00200032003000320034005c006d0069006e006900 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d949ab6ce5cf0011b9737400005d7360e5cf000000000068e5cf0000000000e9c5cf7100005d7300298a7218001900781ca2720e845d7380e5cf00c4505a7700005d73781ca272e9c5cf71e4e9cf00 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000612371f4612371046223710462237118622371186223712c6223712c622371686223716862237174622371746223719862237198622371ac622371ac622371c0622371c0622371cc622371cc622371e8622371e8622371f4622371f462237104632371046323715077fb0205000005a3e2000088060403b8f2fa0203000003 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000eae77ffffffff24000000b4d7cf0004000000000000005d78d978384b286e102e126f00000000d0d7cf00c424126fa86b1c6f14d8cf00a4c1276e0800000088c1276e2944d2ce384b286ee84a286e00000000b0e18ab7acf8110d80f8110d7062110d0900000080d8cf00d5c3276e4d0754a0feffffff00000000bac1276e (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c6f947729d81875 (UID: 00000000-00007360) "mininterno_mi2024.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000001c007220cc007220c020000000000220c7f0000000c000000c807220c7f000000230000000000010cfeffffff0000220c6002220cb9ff0001000000040000000097000000082f22006002220c7f0000007f000000970000007f000000c807220cc000220c8ce5cf00506aaf77f0c831dcfeffffff00dfcf00b716ac77 (UID: 00000000-00007360)7b:Tbba,Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-81-00454100 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-349-00476740 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00005820-4077-507-004396E0 Assembly shows XOR instruction xor word ptr [esi] ax in Stream UID: 00000000-00005820-4077-507-004396E0 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 00000000-00005820-4077-507-004396E0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-526-00437AC4 Assembly shows XOR instruction xor dword ptr [eax] esp in Stream UID: 00000000-00005820-4077-633-00481B58 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00005820-4077-679-00450E34 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005820-4077-679-00450E34 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-733-00477C74 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-779-004707F8 Assembly shows XOR instruction xor dword ptr [ebp+63h] eax in Stream UID: 00000000-00005820-4077-1050-0045DBAC Assembly shows XOR instruction xor bh bl in Stream UID: 00000000-00005820-4077-1050-0045DBAC Assembly shows XOR instruction xor al byte ptr [ebp+63h] in Stream UID: 00000000-00005820-4077-1050-0045DBAC Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00005820-4077-1082-0044FD73 Assembly shows XOR instruction xor dword ptr [ecx+558BFFFBh] ebp in Stream UID: 00000000-00005820-4077-1136-0044B0AA Assembly shows XOR instruction xor eax 35200041h in Stream UID: 00000000-00005820-4077-1758-0041355C Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005820-4077-2165-00413CF8 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00005820-4077-2786-0045C264 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-2786-0045C264 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-2924-004673A4 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00005820-4077-3371-0049395C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-3612-004143E0 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00005820-4077-4113-0044CD18 Assembly shows XOR instruction xor dl 01h in Stream UID: 00000000-00005820-4077-4121-0044EC5C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-4121-0044EC5C Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00005820-4077-4461-00482200 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005820-4077-6257-004180B9 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005820-4077-6376-0044EEB0 Assembly shows XOR instruction xor dh byte ptr [eax] in Stream UID: 00000000-00005820-4077-6381-0044FF147c:T2486,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02caf75aced2f01226e517700006a03000000002d6e51772c1d274a2d000000ecb7a57530ee2f01b1ce980020496e0378ae6d03150000008000000070ed2f0100003e03f4ed2f0170c8527778815f3cfeffffff2d000000d0ccb47527000000c4ed2f01856a53771c23587704ee2f01f85f537708000000bb695277b2695277841e274a2d000000ecb7a57527000000d0ccb475d8ed2f012d000000d0ccb4752700000008ee2f01856a53771c23587750ee2f017e8ab375ee8cb375738ab375dc3affe22d000000ecb7a57527000000d0ccb475b4116a0348116a03dc3affe218ee2f01fc52f17504ef2f01e084b375b4253f96feffffff738ab375 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007148) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b0d8af0038cfac773c36d7021cd9af0001000000f035d7023c36d702f035d702040000000400000000e07f74001000001cd9af0001000000f035d702cd97ac779c97ac77a0bf48ceb50f7674f035d7020000ac7700000000dc09d0730000000080ee7c740100000000000000f8e27f74000000000400000080a9417448407e74f8e27f7420d9af0080e8ca7448efd70280e8ca741cd9af000000000080e8ca74fca0d1fdfeffffff00000000000000000000000013000000c438de020200000002000000180000009838de02c438de020000000071587bcfa0dbaf00ddf3737494d9af00000000009838de0218000000f8f373749838de02 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d0d9e202e8d9e202 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000018e3e2020000d7020000d70218e3e202508cd702508cd7027f070000c000d702020000022cd8af00d2fbaa7701000000ff0700009919000018e3e2020000d70200000000000000000000d70230dde00238dde002fc1d000000000000d8b590040120082999190000991900000000d702000000000000000018f6aa77000000000000d702e0e5e20218e3e20200000000000000000000000018e3e202d8b59004e0dcaf00bcdcaf0081f18e77d8b59004f8e1af0088deaf00c5f18e770000d7029834ac771049e202e8dcaf001c608b7704000000e0dcaf005c83bf74d0b59004a0909277000000009cd9af0000000000 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c6e3e202dce3e202 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000aefae202c6fae202 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6f9e202eaf9e202 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008e15e302a615e302 (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008e15e302a415e302 (UID: 00000000-00007280)7d:Ta49,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6ECB2000.00000002.mdmp, 00000000-00007360.00000001.143647.6ED78000.00000002.mdmp, 00000000-00007360.00000001.143647.6EDAC000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE4F000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE73000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp, 00000000-00007360.00000001.143647.6EF5C000.00000002.mdmp, 00000000-00007360.00000001.143647.6F032000.00000002.mdmp, 00000000-00007360.00000001.143647.6F053000.00000002.mdmp, 00000000-00007360.00000001.143647.6F063000.00000002.mdmp, 00000000-00007360.00000001.143647.6F09A000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0C9000.00000002.mdmp, 00000000-00007360.00000001.143647.6F0E3000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.726F3000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp")7e:T1bde,"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-EMSM1.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\unins000.exe (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7E6GQ.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_mi2024.exe (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-1CGA1.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\7z.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-QG48B.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.Compact.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-K6V14.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-DQ038.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Data.v11.1.Linq.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GBLD8.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Printing.v11.1.Core.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-D7NRE.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.Utils.v11.1.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6B3FL.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.Design.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-G42MV.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\DevExpress.XtraEditors.v11.1.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-9K06Q.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\edenadiffp32.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-KM2E6.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mi2024fa.qfi (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-GSVCD.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mi2024fef.qfi (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LFH1M.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\mininterno_gdf_res.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-52M3E.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\Mininterno_mi2024.exe (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-6HN0B.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\PdfSharp.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-F59M3.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\SevenZipSharp.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-7ULT6.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\System.Data.SQLite.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-LL53S.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\zlibwapi.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\is-S6JLK.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\zxing.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-TRGVG.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\dependentlibs.list (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-4HI76.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.chk (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-719ST.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\freebl3.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-DEVLP.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\IA2Marshal.dll (UID: 00000000-00007280) "SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\is-V2HFB.tmp & %PROGRAMFILES%\(x86)\Edena SRL\Mininterno.net Ministero Iterno 2024\runtime\javaxpcom.jar (UID: 00000000-00007280)7f:T796,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 0046E180h" at 00000000-00005820-4077-599-0046E13C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 0045CBF5h" at 00000000-00005820-4077-708-0045CBC0 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "jc 00411854h" at 00000000-00005820-4077-2134-004116F4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0042D9CFh" at 00000000-00005820-4077-2415-0042D974 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0042E119h" at 00000000-00005820-4077-2420-0042E09C Found API call GetDiskFreeSpaceA@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 00455F13h" at 00000000-00005820-4077-2718-00455E0C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 00462D4Dh" at 00000000-00005820-4077-2852-00462CD8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00462EA3h" at 00000000-00005820-4077-2855-00462E30 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049C5C4h]" at 00000000-00005820-4077-3432-00419040 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp bl, 04h" and "jnc 0041F161h" at 00000000-00005820-4077-3435-0041F118 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00462E0Ah" at 00000000-00005820-4077-4269-00462D90 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 00462C67h" at 00000000-00005820-4077-4270-00462BE0 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0045037Ch" at 00000000-00005820-4077-4451-004502C0 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 0044EF5Bh" at 00000000-00005820-4077-6376-0044EEB080:T7c2,Found registry deletion API: "RegDeleteKeyExA" in file "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry deletion API: "nction RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry deletion API: "RegDeleteValueA" in file "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5" Found registry deletion API: "RegDeleteKeyW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00005820.00000001.76978.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp"81:T5f0,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "SecuriteInfo.com.Win32.Malware-gen.7360.1737") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00007280.00000001.134794.72F57000.00000002.mdmp")82:T4ca,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetDC" (Indicator: "GetDC"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp")83:Te38,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002608.00000001.83949.00781000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00005820.00000000.75056.002E0000.00000004.mdmp "Software\Microso" in Source: 00000000-00005820.00000000.75056.002E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005820.00000000.75056.004A2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005820.00000000.75056.004A2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005820.00000000.75056.004A2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00005820.00000000.75056.004A2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00005820.00000001.76978.002E0000.00000004.mdmp "Software\Microso" in Source: 00000000-00005820.00000001.76978.002E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005820.00000001.76978.00401000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00005820.00000002.78904.002E0000.00000004.mdmp "Software\Microso" in Source: 00000000-00005820.00000002.78904.002E0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00005820.00000003.84368.002E0000.00000004.mdmp "Software\Microso" in Source: 00000000-00005820.00000003.84368.002E0000.00000004.mdmp84:T586,Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005820.00000000.75056.004A2000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00005820.00000001.76978.00401000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp")85:T455f,Found URL "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupsvw3;b(u." - Source: "00000000-00007148.00000000.132802.00401000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007148.00000000.132802.036D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007148.00000002.136643.036D0000.00000004.mdmp") Found URL "http://www.mininterno.net/http://www.mininterno.net/http://www.mininterno.net/" - Source: "00000000-00007148.00000002.136643.05450000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007280.00000000.132876.02D70000.00000004.mdmp") Found URL "http://www.mininterno.net/http://www.mininterno.net/http://www.mininterno.net/" - Source: "00000000-00007280.00000000.132876.04FD8000.00000004.mdmp") Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/pszyyd_^[y]exception" - Source: "00000000-00007280.00000001.134794.00401000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007280.00000001.134794.02D70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007280.00000002.136716.02D70000.00000004.mdmp") Found URL "http://www.mininterno.net/http://www.mininterno.net/http://www.mininterno.net/" - Source: "00000000-00007280.00000002.136716.04FD8000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json07/13" - Source: "00000000-00007360.00000001.143647.08AB0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,007/13" - Source: "00000000-00007360.00000001.143647.08AB0000.00000002.mdmp") Found URL "http://exslt.org/regular-expressions@mozilla.org/exslt/regexp;1history-observersused" - Source: "00000000-00007360.00000001.143647.0C100000.00000004.mdmp") Found URL "http://sqlite.phxsoftware.compublic" - Source: "00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp") Found URL "http://sqlite.phxsoftware.comfiledescriptionsystem.data.sqlite" - Source: "00000000-00007360.00000001.143647.0D3DD000.00000002.mdmp") Found URL "http://sqlite.phxsoftware.compublic" - Source: "00000000-00007360.00000001.143647.0D493000.00000002.mdmp") Found URL "http://www.e-szigno.hu/szsz/0xzw" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://acedicom.edicomgroup.com/doc0rqb&" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.sk.ee/cps/0+$0" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.sk.ee/juur/crl/0/+5xyliy*" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.disig.sk/ca0f_0]0-'http://www.disig.sk/ca/crl/ca_disig.crl0,&http://ca.disig.sk/ca/crl/ca_disig.crl0]4tal" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy-g20ajg*b4b5&-]" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?verisign," - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crl0-pw0" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://fedir.comsign.co.il/crl/comsignsecuredca.crl0x&ford" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://fedir.comsign.co.il/crl/comsignca.crl0tvbqmn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectutn" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0990709181042z190709181922z0salt" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0i." - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-hardware.crl01" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardwareutn" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1604-utn-userfirst-client" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-clientauthenticationandemail.crl0so%$oh$q'6%%gsalt" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1utn" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.usertrust.com/utn-datacorpsgc.crl0*z0&ueg)k,v?" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.certifikat.dk/repository0tdc0certifikater" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.oces.certifikat.dk/oces.crl0+20030211083930z20370211090930z0v6.0:4.0ca)b1p't>t]th" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy0ut6a" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.ips.es/0)http://www.ips.es/ips2002/0@1http://www.ips.es/ips2002/ips2002timestamping.crl0e6http://www.ips.es/ips2002/revocationtimestamping.html?0b3http://www.ips.es/ips2002/renewaltimestamping.html?0@1http://www.ips.es/ips2002/policytimestamping.html0x0v071http://www.ips.es/ips2002/ips2002timestamping.crl0;5http://wwwback.ips.es/ips2002/ips2002timestamping.crl0/" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://ocsp.ips.es/0g-hzpex,!d" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.ips.es/0)http://www.ips.es/ips2002/0;,http://www.ips.es/ips2002/ips2002clasea3.crl0@1http://www.ips.es/ips2002/revocationclasea3.html?0=.http://www.ips.es/ips2002/renewalclasea3.html?0;,http://www.ips.es/ips2002/policyclasea3.html0un0l02,http://www.ips.es/ips2002/ips2002clasea3.crl060http://wwwback.ips.es/ips2002/ips2002clasea3.crl0/" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://ocsp.ips.es/0j=" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.ips.es/0)http://www.ips.es/ips2002/0;,http://www.ips.es/ips2002/ips2002clasea1.crl0@1http://www.ips.es/ips2002/revocationclasea1.html?0=.http://www.ips.es/ips2002/renewalclasea1.html?0;,http://www.ips.es/ips2002/policyclasea1.html0un0l02,http://www.ips.es/ips2002/ips2002clasea1.crl060http://wwwback.ips.es/ips2002/ips2002clasea1.crl0/" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://ocsp.ips.es/0kx" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.ips.es/0)http://www.ips.es/ips2002/0:+http://www.ips.es/ips2002/ips2002clase3.crl0?0http://www.ips.es/ips2002/revocationclase3.html?0<-http://www.ips.es/ips2002/renewalclase3.html?0:+http://www.ips.es/ips2002/policyclase3.html0sl0j01+http://www.ips.es/ips2002/ips2002clase3.crl05/http://wwwback.ips.es/ips2002/ips2002clase3.crl0/" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://ocsp.ips.es/0" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.ips.es/0)http://www.ips.es/ips2002/0:+http://www.ips.es/ips2002/ips2002clase1.crl0?0http://www.ips.es/ips2002/revocationclase1.html?0<-http://www.ips.es/ips2002/renewalclase1.html?0:+http://www.ips.es/ips2002/policyclase1.html0sl0j01+http://www.ips.es/ips2002/ips2002clase1.crl05/http://wwwback.ips.es/ips2002/ips2002clase1.crl0/" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://ocsp.ips.es/0r?,jcw" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.ips.es/0)http://www.ips.es/ips2002/07(http://www.ips.es/ips2002/ips2002cac.crl0<-http://www.ips.es/ips2002/revocationcac.html?09*http://www.ips.es/ips2002/renewalcac.html?07(http://www.ips.es/ips2002/policycac.html0mf0d0.(http://www.ips.es/ips2002/ips2002cac.crl02,http://wwwback.ips.es/ips2002/ips2002cac.crl0/" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://ocsp.ips.es/0sc$" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.comodoca.com/trustedcertificateservices.crl0:4http://crl.comodo.net/trustedcertificateservices.crl06fdp?mz9@gujz!greater" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.comodoca.com/securecertificateservices.crl093http://crl.comodo.net/securecertificateservices.crl0greater" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.trustcenter.de/guidelines0-e!c" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.trustcenter.de/guidelines0jtb$1qoxvfgpqdhamburg1hamburg1:081tc" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.usertrust.com1+0)" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-networkapplications.crl0t" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.betrusted.com/products_services/index.html06reliance" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.betrusted.com/products_services/index.html0" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "https://www.betrusted.com/products_services/index.html0b6https://www.betrusted.com/products_services/index.html0w0u1" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.betrusted.com/products_services/index.html0a5http://www.betrusted.com/products_services/index.html0dkjn" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "https://www.betrusted.com/vault/terms01%https://www.betrusted.com/vault/terms04-0+0)" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.entrust.net/crl/client1.crl0+19991012192430z20191012192430z0v4.0entrust.net1h0f?www.entrust.net/client_ca_info/cps" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.entrust.net/crl/net1.crl0+19990525160940z20190525160940z0v4.0r>m-eentrust.net1;092www.entrust.net/cps" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://www.valicert.com/1" - Source: "00000000-00007360.00000001.143647.6EE8B000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "GetDC"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["installcore"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"datami2024fa.db.vr","sha256":"f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-9K06Q.tmp","sha256":"0c80e25f29460bf02d545a918a5f534ccdc489b56f22543122d04927222c8ecb","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-6HN0B.tmp","sha256":"b2b8d5d4331c2aea0437b50e7460f12ac01fd29a915959abdb324382ab7352f7","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"12743ded9ce723e8fda455a4ff4f05089f7f91a988e58a95d5345835282f2466","sha256":"12743ded9ce723e8fda455a4ff4f05089f7f91a988e58a95d5345835282f2466","sources":[{"report_id":"","report_type":"qsp"}],"verdict":"undetected"},{"name":"mi2024_spec","sha256":"90fc24d0399b0a6b46198693a0ba4887a3e3f58f05ba1561c40c0bfd58932206","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-1CGA1.tmp","sha256":"f7e6fb7f23ac191ccae310deaea112d03a17d507755d3e041d4213c02ad7be9d","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"datami2024fa.db.st","sha256":"83e24203f3532a5d379e2dfcab2a0bffa0b0d059eddc22ab04155ed229343ef3","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-EMSM1.tmp","sha256":"6ae296011a4f9a56d06d0a9a01ee7bb20edcf8d9e4e72498b6f6aeb7de94fb3a","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"statmi2024fa.db.ve","sha256":"13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-F59M3.tmp","sha256":"49284b31f28d0a62d797cfcf17f464c8c2b22b29d0e8ab7c15c94724d83e595c","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-7E6GQ.tmp","sha256":"af739d301fe80add69a685d78ccd34923bb69aa10e5c984d284ffcd03f6b6b3d","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"dism.log","sha256":"023e253cb217299900cbffe39b879f7e72a096151c0fcc9c87b54f7bd99a3dc9","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-LFH1M.tmp","sha256":"a510f82db9a3c1da18a2f0332d50040a47152afb0fe161c49df2db673a973901","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-6B3FL.tmp","sha256":"9cda5c285a10cb997ff41d37e70d453e9f96e8bfd2b68312e481c45f734082f1","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"temp.bin","sha256":"d32d0313ff3c4f4b950913870e27a9893587a66430875a82796d35fd6ee9e530","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-7ULT6.tmp","sha256":"49261be7f20c9d9dfd1ff35d71e9f3b1b7de17f65581c67beed43d933f1eb85c","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"DISMHOST.EXE.6A9F4C6C.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-G42MV.tmp","sha256":"abb94156314c2cdf6c7c7042b83374c83368eb127df4236b0a13b87078e938c2","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-DQ038.tmp","sha256":"71b3f00765480e9427da100960ad605ab080574505dd842b4e19f2f98cb23d4f","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-K6V14.tmp","sha256":"2e4ca99a7a611095d56f079bb3b1502051841e7b243dbb7c27685eeaa30331a6","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-QG48B.tmp","sha256":"0b82dfcd52d83205330e5acc1360166b7ae5590a048fde63d86383feafab3ba8","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-D7NRE.tmp","sha256":"a1215955cafd9311427d80b96d657da7478dbb748ca108bbcb9a5e89de57e745","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp","sha256":"451f8e49c4b298cec528eef7f7845e882cd32607d9efa81048faad2002382c18","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Mininterno.net Ministero Iterno 2024.lnk","sha256":"e0b43fc123551be9bf90563bea6d02e5d3bfb5d6838e38fc87720f36941559d1","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"is-GBLD8.tmp","sha256":"6aef03b0c2a394606b5f842591749a0d9a89cb547d2959203cdee3d1b0f61a28","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%WINDIR%\\assembly","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-PQSBE.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-V1MCG.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-DQ038.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-83218.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-KMT1I.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-1C7BE.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-3B59M.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-S6JLK.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-VSP4N.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-DEVLP.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-QHMNU.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-QEMVC.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-20E8U.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-KM2E6.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-TBFJM.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-NUVS5.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-5M01E.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-VLRP7.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-7F45L.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-CAUL4.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-B1JN7.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-H3S5D.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-GCKFN.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-1CGA1.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-DOOPQ.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-LL53S.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-UNG16.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-G42MV.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\datami2024fa.db","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-CV8K6.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-L9GS0.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-9K06Q.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-NGBQ0.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-OH6G3.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-1R1QT.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-6B3FL.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-4HI76.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-EMSM1.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-6HN0B.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-K0EVT.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-UF49Q.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Mininterno\\Global\\settings\\mi2024_spec","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\xpti.dat.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-F61EM.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-08837.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-5CN7Q.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-IBL3F.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-LIB0D.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-IPF1Q.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-LLJ65.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-7E6GQ.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-DS9AC.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-KV097.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-AA1TO.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-OQGIA.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\unins000.dat","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-P4B6K.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-QG48B.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-HEEP8.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-EBD8V.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-S1NS0.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-K6V14.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-R2LN9.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-S0566.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-4FG2A.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-SKNHO.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-719ST.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-FFQ8G.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-41714.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-ALCCE.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-TJDV7.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-4F3HR.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-9L9CJ.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-GSVCD.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-D7NRE.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-C44CG.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-7ULT6.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-GBLD8.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-7C81V.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-F59M3.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-S1MDA.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-V2HFB.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%TEMP%\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\statmi2024fa.db","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-NCQAK.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-1F6P0.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-SBD43.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-6KGS7.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-LEN3M.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-VCSJQ.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-52M3E.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\datami2024fa.db.ve","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-G955G.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-4LB1F.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-UN5RQ.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-VAEDV.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-Q6G65.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\chrome\\is-L7AG2.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-16HG7.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%TEMP%\\is-6E1P4.tmp\\_isetup\\_setup64.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-3HIN0.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-61E80.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%WINDIR%\\assembly\\Desktop.ini","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-2T06T.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%TEMP%\\is-M0F89.tmp\\b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-EN6JB.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-J6JEL.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-TRGVG.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%TEMP%\\is-6E1P4.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-FK8E2.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\datami2024fa.db-journal","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-VGB6P.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-O065N.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\statmi2024fa.db.ve","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-GTJ2F.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\is-LFH1M.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%TEMP%\\is-4FECA.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-Q2LUJ.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\is-987IU.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-4UN1E.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\is-2CPI1.tmp","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"DBWinMutex","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"SM0:7360:168:WilStaging_02","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"SM0:7148:168:WilStaging_02","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"Local\\SM0:7280:168:WilStaging_02","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"SM0:7360:64:WilError_01","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"name":"Local\\SM0:7360:168:WilStaging_02","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"Local\\SM0:7148:168:WilStaging_02","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"name":"SM0:7280:64:WilError_01","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["mscoree.dll","Culture.dll","api-ms-win-core-file-l2-1-0.dll","IA2Marshal.dll","VxSSL32.dll","nss3.dll","mininterno_gdf_res.dll","System.Drawing.ni.dll","cryptsp.dll","SHCore.dll","advapi32.dll","GdiPlus.dll","softokn3.dll","wow64cpu.dll","shfolder.dll","nspr4.dll","bcryptprimitives.dll","System.Data.ni.dll","sspicli.dll","shell32.dll","sfc_os.dll","api-ms-win-core-timezone-l1-1-0.dll","msimg32.dll","dwmapi.dll","mozcrt19.dll","srvcli.dll","xul.dll","System.Data.SQLite.dll","fltLib.dll","win32u.dll","msvcrt.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","WindowsCodecs.dll","mscorwks.dll","apphelp.dll","xpcom.dll","crypt32.dll","msvcp_win.dll","msctf.dll","msvcr80.dll","nsi.dll","psapi.dll","comctl32.dll","gdi32full.dll","System.ni.dll","ExplorerFrame.dll","rsaenh.dll","ole32.dll","gdi32.dll","System.Windows.Forms.ni.dll","wow64win.dll","api-ms-win-crt-math-l1-1-0.dll","mscoreei.dll","fusion.dll","usp10.dll","nssdbm3.dll","windows.storage.dll","api-ms-win-crt-locale-l1-1-0.dll","aepic.dll","msasn1.dll","comdlg32.dll","oleaut32.dll","ntshrui.dll","wow64.dll","lpk.dll","api-ms-win-crt-utility-l1-1-0.dll","System.Transactions.ni.dll","wsock32.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-time-l1-1-0.dll","RstrtMgr.dll","DevExpress.Data.v11.1.dll","System.EnterpriseServices.dll","winmm.dll","api-ms-win-core-file-l1-2-0.dll","DevExpress.Utils.v11.1.dll","kernel.appcore.dll","js3250.dll","nssutil3.dll","freebl3.dll","msvcp140.dll","_shfoldr.dll","api-ms-win-core-localization-l1-2-0.dll","bcrypt.dll","IPHLPAPI.DLL","KernelBase.dll","TextInputFramework.dll","System.Configuration.ni.dll","plds4.dll","api-ms-win-crt-environment-l1-1-0.dll","imageres.dll","combase.dll","netmsg.dll","DWrite.dll","smime3.dll","vcruntime140.dll","ucrtbase.dll","ntasn1.dll","mscorjit.dll","CoreMessaging.dll","linkinfo.dll","api-ms-win-core-synch-l1-2-0.dll","CoreUIComponents.dll","WinTypes.dll","propsys.dll","api-ms-win-crt-string-l1-1-0.dll","clbcatq.dll","mpr.dll","ws2_32.dll","sfc.dll","api-ms-win-crt-convert-l1-1-0.dll","rpcss.dll","shfusion.dll","cfgmgr32.dll","version.dll","System.Transactions.dll","cldapi.dll","ShFusRes.dll","profapi.dll","shlwapi.dll","user32.dll","sechost.dll","plc4.dll","javaxpcomglue.dll","mscorlib.ni.dll","imm32.dll","ncrypt.dll","tiptsf.dll","kernel32.dll","rpcrt4.dll","System.Data.dll","cryptbase.dll","cscapi.dll","nssckbi.dll","netutils.dll","setupapi.dll","System.Xml.ni.dll","powrprof.dll","uxtheme.dll","api-ms-win-crt-heap-l1-1-0.dll","Accessibility.ni.dll","sqlite3.dll","System.Design.dll","winmmbase.dll","ssl3.dll","ntdll.dll","ntmarta.dll","api-ms-win-crt-runtime-l1-1-0.dll","DevExpress.XtraEditors.v11.1.dll"],"processes":[{"command_line":"","icon":"$22","name":"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe","normalized_path":"C:\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe","pid":7148,"ppid":0,"sha256":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","uid":"00000000-00007148"},{"command_line":"/SL5=\"$6030C,18723894,214016,C:\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\"","name":"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp","normalized_path":"%TEMP%\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp","parent_uid":"00000000-00007148","pid":7280,"ppid":7148,"sha256":"451f8e49c4b298cec528eef7f7845e882cd32607d9efa81048faad2002382c18","uid":"00000000-00007280"},{"command_line":"","name":"mininterno_mi2024.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\mininterno_mi2024.exe","parent_uid":"00000000-00007280","pid":7360,"ppid":7280,"sha256":"1e396cfa00cefd46edb83f00648fafbcfb228e526c95592a0c156a06228bd839","uid":"00000000-00007360"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-09-07T21:26:14+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"6a9f2bf38c77a4378b081386","indicators_count":{"informative":180,"malicious":0,"suspicious":39},"is_in_unified_schema":true,"malware_family":"Suspicious:W32.InstallCore.XB.hwzw","state":"SUCCESS","submit_name":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","tags":["Multi-Process","Extracted Files"],"threat_score":78,"verdict":"suspicious"},{"analysis_start_time":"2024-07-13T00:29:50+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"6691ca7b987b38c4160f942a","indicators_count":{"informative":231,"malicious":2,"suspicious":59},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"SecuriteInfo.com.Win32.Malware-gen.7360.1737","tags":["Multi-Process","Extracted Files"],"threat_score":39,"verdict":"suspicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":25,"files_deleted_count":0,"files_written_count":127,"http_requests_count":0,"imported_dlls_count":150,"injected_processes_count":0,"mutex_created_count":12,"process_count":3,"registry_keys_created_count":5,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"SUCCESS","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Riskware"},{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Suspicious:InstallCore.XB.hwzw"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of Generik.GCVJOFK trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Suspicious:W32.InstallCore.XB.hwzw.mg","verdict":"malicious"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Agent.blpu!crit","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/ABTrojan.CRTA-5960","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.InnoDrp.GZH","verdict":"malicious"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Queries process information"}],"details_count":1,"name":"Fingerprint","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"details":[{"detail":"Able to discover network shares"}],"details_count":1,"name":"Spreading","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]}],"intel_graph":{"chains":[{"edges":[{"edge_kind":"extracted_from_archive","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:12743ded9ce723e8fda455a4ff4f05089f7f91a988e58a95d5345835282f2466"}],"id":"1546632744951632281","root":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","verdict":{"verdict":"unknown"}},{"edges":[],"id":"1546632786210183923","root":"File:f7e6fb7f23ac191ccae310deaea112d03a17d507755d3e041d4213c02ad7be9d","verdict":{"reasons":["File found in known legitimate files database","File has very high prevalence"],"verdict":"likely_benign","verdict_source":"observed prevalence"}},{"edges":[{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:0c80e25f29460bf02d545a918a5f534ccdc489b56f22543122d04927222c8ecb"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:b2b8d5d4331c2aea0437b50e7460f12ac01fd29a915959abdb324382ab7352f7"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:12743ded9ce723e8fda455a4ff4f05089f7f91a988e58a95d5345835282f2466"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:90fc24d0399b0a6b46198693a0ba4887a3e3f58f05ba1561c40c0bfd58932206"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:f7e6fb7f23ac191ccae310deaea112d03a17d507755d3e041d4213c02ad7be9d"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:83e24203f3532a5d379e2dfcab2a0bffa0b0d059eddc22ab04155ed229343ef3"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:6ae296011a4f9a56d06d0a9a01ee7bb20edcf8d9e4e72498b6f6aeb7de94fb3a"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:49284b31f28d0a62d797cfcf17f464c8c2b22b29d0e8ab7c15c94724d83e595c"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:af739d301fe80add69a685d78ccd34923bb69aa10e5c984d284ffcd03f6b6b3d"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:023e253cb217299900cbffe39b879f7e72a096151c0fcc9c87b54f7bd99a3dc9"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:a510f82db9a3c1da18a2f0332d50040a47152afb0fe161c49df2db673a973901"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:9cda5c285a10cb997ff41d37e70d453e9f96e8bfd2b68312e481c45f734082f1"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:d32d0313ff3c4f4b950913870e27a9893587a66430875a82796d35fd6ee9e530"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:49261be7f20c9d9dfd1ff35d71e9f3b1b7de17f65581c67beed43d933f1eb85c"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:abb94156314c2cdf6c7c7042b83374c83368eb127df4236b0a13b87078e938c2"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:71b3f00765480e9427da100960ad605ab080574505dd842b4e19f2f98cb23d4f"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:2e4ca99a7a611095d56f079bb3b1502051841e7b243dbb7c27685eeaa30331a6"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:0b82dfcd52d83205330e5acc1360166b7ae5590a048fde63d86383feafab3ba8"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:a1215955cafd9311427d80b96d657da7478dbb748ca108bbcb9a5e89de57e745"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:451f8e49c4b298cec528eef7f7845e882cd32607d9efa81048faad2002382c18"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:e0b43fc123551be9bf90563bea6d02e5d3bfb5d6838e38fc87720f36941559d1"},{"edge_kind":"extracted","from_key":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","to_key":"File:6aef03b0c2a394606b5f842591749a0d9a89cb547d2959203cdee3d1b0f61a28"}],"id":"sandbox_files","root":"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","verdict":{"verdict":"unknown","verdict_source":"sandbox"}}],"map":{"File:023e253cb217299900cbffe39b879f7e72a096151c0fcc9c87b54f7bd99a3dc9":{"type":"File","value":"023e253cb217299900cbffe39b879f7e72a096151c0fcc9c87b54f7bd99a3dc9"},"File:0b82dfcd52d83205330e5acc1360166b7ae5590a048fde63d86383feafab3ba8":{"type":"File","value":"0b82dfcd52d83205330e5acc1360166b7ae5590a048fde63d86383feafab3ba8"},"File:0c80e25f29460bf02d545a918a5f534ccdc489b56f22543122d04927222c8ecb":{"type":"File","value":"0c80e25f29460bf02d545a918a5f534ccdc489b56f22543122d04927222c8ecb"},"File:12743ded9ce723e8fda455a4ff4f05089f7f91a988e58a95d5345835282f2466":{"filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert","type":"File","value":"12743ded9ce723e8fda455a4ff4f05089f7f91a988e58a95d5345835282f2466"},"File:13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354":{"type":"File","value":"13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354"},"File:2e4ca99a7a611095d56f079bb3b1502051841e7b243dbb7c27685eeaa30331a6":{"type":"File","value":"2e4ca99a7a611095d56f079bb3b1502051841e7b243dbb7c27685eeaa30331a6"},"File:451f8e49c4b298cec528eef7f7845e882cd32607d9efa81048faad2002382c18":{"type":"File","value":"451f8e49c4b298cec528eef7f7845e882cd32607d9efa81048faad2002382c18"},"File:49261be7f20c9d9dfd1ff35d71e9f3b1b7de17f65581c67beed43d933f1eb85c":{"type":"File","value":"49261be7f20c9d9dfd1ff35d71e9f3b1b7de17f65581c67beed43d933f1eb85c"},"File:49284b31f28d0a62d797cfcf17f464c8c2b22b29d0e8ab7c15c94724d83e595c":{"type":"File","value":"49284b31f28d0a62d797cfcf17f464c8c2b22b29d0e8ab7c15c94724d83e595c"},"File:6ae296011a4f9a56d06d0a9a01ee7bb20edcf8d9e4e72498b6f6aeb7de94fb3a":{"type":"File","value":"6ae296011a4f9a56d06d0a9a01ee7bb20edcf8d9e4e72498b6f6aeb7de94fb3a"},"File:6aef03b0c2a394606b5f842591749a0d9a89cb547d2959203cdee3d1b0f61a28":{"type":"File","value":"6aef03b0c2a394606b5f842591749a0d9a89cb547d2959203cdee3d1b0f61a28"},"File:71b3f00765480e9427da100960ad605ab080574505dd842b4e19f2f98cb23d4f":{"type":"File","value":"71b3f00765480e9427da100960ad605ab080574505dd842b4e19f2f98cb23d4f"},"File:83e24203f3532a5d379e2dfcab2a0bffa0b0d059eddc22ab04155ed229343ef3":{"type":"File","value":"83e24203f3532a5d379e2dfcab2a0bffa0b0d059eddc22ab04155ed229343ef3"},"File:90fc24d0399b0a6b46198693a0ba4887a3e3f58f05ba1561c40c0bfd58932206":{"type":"File","value":"90fc24d0399b0a6b46198693a0ba4887a3e3f58f05ba1561c40c0bfd58932206"},"File:9cda5c285a10cb997ff41d37e70d453e9f96e8bfd2b68312e481c45f734082f1":{"type":"File","value":"9cda5c285a10cb997ff41d37e70d453e9f96e8bfd2b68312e481c45f734082f1"},"File:a1215955cafd9311427d80b96d657da7478dbb748ca108bbcb9a5e89de57e745":{"type":"File","value":"a1215955cafd9311427d80b96d657da7478dbb748ca108bbcb9a5e89de57e745"},"File:a510f82db9a3c1da18a2f0332d50040a47152afb0fe161c49df2db673a973901":{"type":"File","value":"a510f82db9a3c1da18a2f0332d50040a47152afb0fe161c49df2db673a973901"},"File:abb94156314c2cdf6c7c7042b83374c83368eb127df4236b0a13b87078e938c2":{"type":"File","value":"abb94156314c2cdf6c7c7042b83374c83368eb127df4236b0a13b87078e938c2"},"File:af739d301fe80add69a685d78ccd34923bb69aa10e5c984d284ffcd03f6b6b3d":{"type":"File","value":"af739d301fe80add69a685d78ccd34923bb69aa10e5c984d284ffcd03f6b6b3d"},"File:b2b8d5d4331c2aea0437b50e7460f12ac01fd29a915959abdb324382ab7352f7":{"type":"File","value":"b2b8d5d4331c2aea0437b50e7460f12ac01fd29a915959abdb324382ab7352f7"},"File:b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5":{"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec","type":"File","value":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","verdict":{"reasons":["Associated with known malicious activity"],"verdict":"malicious","verdict_source":"dynamic and static analysis"}},"File:d32d0313ff3c4f4b950913870e27a9893587a66430875a82796d35fd6ee9e530":{"type":"File","value":"d32d0313ff3c4f4b950913870e27a9893587a66430875a82796d35fd6ee9e530"},"File:e0b43fc123551be9bf90563bea6d02e5d3bfb5d6838e38fc87720f36941559d1":{"type":"File","value":"e0b43fc123551be9bf90563bea6d02e5d3bfb5d6838e38fc87720f36941559d1"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04":{"type":"File","value":"f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04"},"File:f7e6fb7f23ac191ccae310deaea112d03a17d507755d3e041d4213c02ad7be9d":{"type":"File","value":"f7e6fb7f23ac191ccae310deaea112d03a17d507755d3e041d4213c02ad7be9d","verdict":{"reasons":["File found in known legitimate files database","File has very high prevalence"],"verdict":"likely_benign","verdict_source":"observed prevalence"}}}},"mitre_attacks":[{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}],"tactic":"Impact","technique":"Disk Content Wipe"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerade File Type"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Persistence","technique":"Shortcut Modification"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Search Order Hijacking"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Contains ability to write/modify file content (Powershell command string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Installer Packages"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Make and Impersonate Token"},{"attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Storage Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate services"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Kernel Modules and Extensions"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Network Share Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Impact","technique":"Internal Defacement"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Double File Extension"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Digital Certificates"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded PDF document"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"}],"rule_matches":{},"sandbox_signatures":[{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetUserNameA\" (UID: 00000000-00007280)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$23","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Spyware/Information Retrieval","description":"\"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\is-M0F89.tmp\\*.* (UID: 00000000-00005856)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005856)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" called \"FindNextFileW\" with parameter b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp (UID: 00000000-00005856)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" called \"FindFirstFileA\" with parameter %TEMP%\\is-M0F89.tmp\\b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp (UID: 00000000-00005820)","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"\"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"OWNER\"; Value: \"BC16000073E3388F0F3FDD0100\")\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"SESSIONHASH\"; Value: \"A74D44CEE3A89829DB64BADBF8348B8E34A17D47B519F0176ED0173EF0DBD35700\")\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"SEQUENCE\"; Value: \"0100000000\")","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mininterno Ministero Interno 2024\\Mininterno.net Ministero Iterno 2024.lnk\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Mininterno.net Ministero Iterno 2024.lnk\"","id":"api-203","level":"informative","mitre_attack_id":"T1083","name":"Tries to access LNK files (Windows shortcut)","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00005820-4077-2718-00455E0C","id":"stream-37","level":"informative","mitre_attack_id":"T1497.001","name":"Contains ability to query volume size","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"\"Inserts String2 into String1 at the position specified by StartPositon\" (Source: 00000000-00007360.00000001.143647.0A142000.00000002.mdmp, Indicator: \"inserts string2 into string1 at the position specified by startpositon\")","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Able to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$24","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"$25","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-224","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve the local name for a socket (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A9F4C6C.bin\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$27","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005820.00000000.75056.004A2000.00000002.mdmp, 00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\"","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Able to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"select * from \"; File: \"is-F61EM.tmp\")","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$28","id":"static-107","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to load content into memory (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve logical drive information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$29","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007280.00000000.132876.004A2000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005856.00000002.78832.0040B000.00000004.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Able to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Spyware/Information Retrieval","description":"$2a","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Able to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed function \"ToBase64String\" in \"is-D7NRE.tmp\"\n Observed function \"FromBase64String\" in \"is-D7NRE.tmp\"\n Observed function \"ToBase64String\" in \"is-GBLD8.tmp\"\n Observed function \"FromBase64String\" in \"is-GBLD8.tmp\"","id":"static-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode string content at runtime (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" searching for class \"Shell_TrayWnd\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2b","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"$2c","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"$2d","id":"static-86","level":"informative","mitre_attack_id":"T1135","name":"Imports windows networking related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$2e","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Program Files (x86)\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"mininterno_mi2024.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7360)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"is-GBLD8.tmp\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"is-GBLD8.tmp\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"is-F59M3.tmp\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTime\" in \"is-F59M3.tmp\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastAccessTime\" in \"is-F59M3.tmp\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetCreationTime\" in \"is-F59M3.tmp\"","id":"static-155","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to set file attributes (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"The input sample dropped 678 files (often an indicator for ransomware)","id":"binary-10","level":"suspicious","mitre_attack_id":"T1491.001","name":"The input sample dropped very many files","origin":"Binary File","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"$2f","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007148)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005820-4077-75-00457A0C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005820-4077-716-004585C8\n GetSystemTime@KERNEL32.DLL at 00000000-00005820-4077-1941-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005820-4077-2739-004579C8\n GetLocalTime@KERNEL32.DLL at 00000000-00005820-4077-3022-0046EA8C\n GetLocalTime@KERNEL32.DLL at 00000000-00005820-4077-3029-0046F038\n GetLocalTime@KERNEL32.DLL at 00000000-00005820-4077-3350-00407DA8\n GetLocalTime@KERNEL32.DLL at 00000000-00005820-4077-3351-00407D7C","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"FindResourceA@KERNEL32.DLL at 00000000-00005820-4077-246-0040ADD8\n FindResourceA@KERNEL32.DLL at 00000000-00005820-4077-269-0040D010\n FreeResource@KERNEL32.DLL at 00000000-00005820-4077-4737-0040D07C","id":"stream-32","level":"suspicious","mitre_attack_id":"T1005","name":"Contains ability to find and load resources of a specific module","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".text\" is \"0x351200\" greater than 0x100000\n Raw size of \"CODE\" is \"0x141800\" greater than 0x100000\n Raw size of \".text\" is \"0x12fc00\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".text\" is \"0x351184\" greater than 0x100000\n Virtual size of \"CODE\" is \"0x141710\" greater than 0x100000\n Virtual size of \".text\" is \"0x12fa04\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"$30","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005856-00000C2B-175469432]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00005820-00000C2B-176860660]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00005820-00000C2B-177033805]\n Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00005820-00000C2B-178578687]\n Observed system executable string:\"%WINDIR%\\system32\\imageres.dll\" [Source: 00000000-00005820-00000C2B-179022805]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00005820-00000C2B-179102558]\n Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00005820-00000C2B-179194262]","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed function \"get_OSVersion\" in \"is-D7NRE.tmp\"\n Observed function \"get_SystemDirectory\" in \"is-6B3FL.tmp\"","id":"static-120","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to gather system information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"is-D7NRE.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"is-D7NRE.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"is-D7NRE.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"is-D7NRE.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"is-GBLD8.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"is-GBLD8.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"is-GBLD8.tmp\"","id":"static-138","level":"informative","mitre_attack_id":"T1012","name":"Dotnet code contains ability to query registry","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$32","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$33","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"$34","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"CreateNamedPipeA@KERNEL32.DLL at 00000000-00005820-4077-716-004585C8","id":"stream-45","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create named pipes for inter-process communication (IPC)","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")","id":"string-417","level":"informative","mitre_attack_id":"T1018","name":"Able to identify remote systems","origin":"File/Memory","relevance":7,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$35","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$36","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$38","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$39","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3a","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3b","id":"api-151","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get active windows title","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3c","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp]- [targetUID: 00000000-00007280]\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- Location: [%TEMP%\\is-6E1P4.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00007280]","id":"binary-33","level":"informative","mitre_attack_id":"T1105","name":"Drops executable files inside temp directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3d","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$3e","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"\"where \"; File: \"is-S82F2.tmp\")\n file/memory contains long string with (Indicator: \"\"where \"; File: \"is-H4T18.tmp\")\n file/memory contains long string with (Indicator: \"\"where \"; File: \"is-CN4UT.tmp\")","id":"string-484","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve files based on search patterns","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetComputerNameA\" (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetComputerNameW\" (UID: 00000000-00007280)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"$3f","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$40","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"is-CAUL4.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"is-CAUL4.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"is-1F6P0.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"is-1F6P0.tmp\")","id":"string-338","level":"informative","mitre_attack_id":"T1132","name":"Contains ability to perform Base64 encoding/decoding","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=Actalis Code Signing CA G2, O=Actalis S.p.A., L=Ponte San Pietro, ST=Bergamo, C=IT\" (SHA1: 3C:30:78:8F:B9:CE:52:35:EB:F3:25:EF:C1:39:75:E0:8A:51:8A:87; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$41","id":"api-113","level":"informative","mitre_attack_id":"T1083","name":"Touches files in program files directory","origin":"API Call","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"is-GBLD8.tmp\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"is-6HN0B.tmp\"","id":"static-134","level":"informative","mitre_attack_id":"T1027","name":"Dotnet file contains encryption/decryption functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$42","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$43","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$44","id":"static-101","level":"informative","mitre_attack_id":"T1106","name":"Found Native API in Dotnet file","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"The entire certificate chain of the input sample was validated successfully.","id":"certificate-2","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a valid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for invalid Relocation Directory of PE file \"sample.bin\"","id":"yara-153","level":"suspicious","mitre_attack_id":"T1027.013","name":"YARA signature match – Anomalous PE file structure","origin":"Static Analysis","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"\"mininterno_mi2024.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\7aa13700a6fcdcb57e6cb353e54d0ab9\\mscorlib.ni.dll\" at 711F0000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00007280.00000001.134794.72F57000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00007280.00000002.136716.72EF1000.00000020.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetActiveWindow\" (UID: 00000000-00007280)\n \"mininterno_mi2024.exe\" called \"GetActiveWindow\" (UID: 00000000-00007360)","id":"api-150","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get handle of currently active window","origin":"API Call","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","id":"api-40","level":"suspicious","mitre_attack_id":"T1056.001","name":"Calls an API typically used for keylogging","origin":"API Call","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-257","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"\"is-D7NRE.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-GBLD8.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-6HN0B.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-QG48B.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-LFH1M.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-6B3FL.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-F59M3.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"is-DQ038.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","id":"static-144","level":"informative","name":"PE file contains COM data directory","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$46","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$47","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"is-GBLD8.tmp\"","id":"static-166","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform CryptoStream operations (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$48","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"file/memory contains long string with (Indicator: \"Set-Content\"; File: \"is-5I4ST.tmp\")","id":"string-331","level":"informative","mitre_attack_id":"T1036.005","name":"Contains ability to write/modify file content (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-6E1P4.tmp\\_isetup\\_setup64.tmp\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-6E1P4.tmp\\_isetup\\_shfoldr.dll\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found PE header \"MZ\" - Source: \"00000000-00007280.00000000.132876.004A2000.00000002.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"+ncalrpc:[OLEBC41493A8EB4959B727B76B493FF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007360.00000001.143647.02FA0000.00000004.mdmp\")","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"is-D7NRE.tmp\"","id":"static-164","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".data\" is zero","id":"static-5","level":"informative","mitre_attack_id":"T1027","name":"PE file contains zero-size sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp\")\n Found reference to API \"{cm:CreateDesktopIcon}\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00007280.00000000.132876.04FD8000.00000004.mdmp, 00000000-00007280.00000002.136716.04FD8000.00000004.mdmp\")","id":"string-541","level":"informative","name":"Contains ability to create/switch the desktop (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" reads file \"c:\\securiteinfo.com.win32.malware-gen.7360.1737.exe\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-663","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment using user register activity","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-313","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to enumerate system network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$49","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" queries basic process information of the \"C:\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" (UID: 7148)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4a","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4b","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"EnumServicesStatusExW\" with parameters {\"hSCManager\": \"2da7f10\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"1\"}","id":"api-174","level":"suspicious","mitre_attack_id":"T1007","name":"Calls an API typically used to enumerate services","origin":"API Call","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4c","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{53F4A621-2752-5851-9F1C-55AB3C457D32}_IS1\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{53F4A621-2752-5851-9F1C-55AB3C457D32}_IS1\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SECURITEINFO.COM.WIN32.MALWARE-GEN.7360.1737.TMP\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$4d","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002608.00000001.83949.00781000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"is-NA6T9.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\defaults\\profile\\US\\is-NA6T9.tmp]","id":"binary-39","level":"informative","mitre_attack_id":"T1105","name":"Drops XML files","origin":"Binary File","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" with commandline \"/SL5=\"$6030C\n18723894\n214016\nC:\\\\SecuriteInfo.com.Win32.Malware- ...\" (UID: 00000000-00007280), Spawned process \"mininterno_mi2024.exe\" (UID: 00000000-00007360)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-126","level":"suspicious","mitre_attack_id":"T1082","name":"Found system commands related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007280.00000001.134794.72F57000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found GetCursorPos() in an import section (Source: SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp)\n Found GetCursorPos() in an import section (Source: is-HEEP8.tmp)\n Found GetCursorPos() in an import section (Source: is-EMSM1.tmp)","id":"static-132","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect sandbox (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"$4e","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"mininterno_mi2024.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindNextFileA@KERNEL32.DLL at 00000000-00005820-4077-81-00454100\n FindFirstFileA@KERNEL32.DLL at 00000000-00005820-4077-94-00452A60\n FindNextFileA@KERNEL32.DLL at 00000000-00005820-4077-643-004800D4\n FindNextFileA@KERNEL32.DLL at 00000000-00005820-4077-778-004722A8\n FindNextFileA@KERNEL32.DLL at 00000000-00005820-4077-2698-004543F4\n FindFirstFileA@KERNEL32.DLL at 00000000-00005820-4077-2844-00462750\n FindFirstFileA@KERNEL32.DLL at 00000000-00005820-4077-2882-00463CDC\n FindFirstFileA@KERNEL32.DLL at 00000000-00005820-4077-2890-00464158\n FindNextFileA@KERNEL32.DLL at 00000000-00005820-4077-2976-0047DA58\n FindFirstFileA@KERNEL32.DLL at 00000000-00005820-4077-3049-0047531C\n FindFirstFileA@KERNEL32.DLL at 00000000-00005820-4077-3407-004985E4","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$4f","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"is-D7NRE.tmp\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"is-GBLD8.tmp\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"is-6B3FL.tmp\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"is-F59M3.tmp\"","id":"static-173","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to load manifest resource from assembly (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$50","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"is-DEVLP.tmp\" contains export function called \"DllGetClassObject\" at ordinal 2","id":"static-177","level":"informative","mitre_attack_id":"T1559.001","name":"Contains ability to retrieve class object from a DLL object handler","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005856)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005856)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005820)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005820)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" connecting to \"\\ThemeApiPort\"\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","mitre_attack_id":"T1559","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00007280)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007148)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007280)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$51","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for AES encryption matched on file \"is-OQGIA.tmp\"\n YARA signature for AES encryption matched on file \"is-1CGA1.tmp\"\n YARA signature for AES encryption matched on file \"is-4F3HR.tmp\"\n YARA signature for AES encryption matched on file \"is-DS9AC.tmp\"","id":"yara-103","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - AES Encryption","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$52","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007280.00000001.134794.72F57000.00000002.mdmp\")","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$53","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found string \"SetDllDirectoryW\" (Source: b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5, API is part of module: KERNEL32.DLL)\n Found string \"SetSearchPathMode\" (Source: b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5, API is part of module: KERNEL32.DLL)\n Found string \"SetProcessDEPPolicy\" (Source: b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5, API is part of module: KERNEL32.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5, API is part of module: KERNELBASE.DLL)","id":"string-64","level":"informative","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Destruction","description":"RemoveDirectoryA@KERNEL32.DLL at 00000000-00005820-4077-87-00452E10\n RemoveDirectoryA@KERNEL32.DLL at 00000000-00005820-4077-757-00472B4C","id":"stream-109","level":"suspicious","mitre_attack_id":"T1070.004","name":"Contains ability to remove directories","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"mininterno_mi2024.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"mininterno_mi2024.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES Encryption","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API SHGetFolderPathA@SHFOLDER.DLL at 00000000-00005820-4077-3117-0047D254","id":"stream-41","level":"informative","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00005820-4077-3172-00483E58","id":"stream-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system","origin":"Hybrid Analysis Technology","relevance":4,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$54","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007148.00000000.132802.036D0000.00000004.mdmp, 00000000-00007148.00000002.136643.036D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007280.00000000.132876.02D70000.00000004.mdmp, 00000000-00007280.00000001.134794.02D70000.00000004.mdmp, 00000000-00007280.00000002.136716.02D70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007360.00000000.141726.02FA0000.00000004.mdmp, 00000000-00007360.00000001.143647.02FA0000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$55","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00007280.00000001.134794.00401000.00000020.mdmp","id":"string-96","level":"informative","mitre_attack_id":"T1012","name":"Found registry key string for installed applications","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"IsWow64Process\" with parameter \"7280\" - (UID: 00000000-00007280)\n \"mininterno_mi2024.exe\" called \"IsWow64Process\" with parameter \"7360\" - (UID: 00000000-00007360)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"mininterno_mi2024.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00007360)","id":"api-144","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to open an existing named mutex object","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"is-GBLD8.tmp\"","id":"static-165","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform symmetric encryption (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$56","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75970000\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75970000\n \"mininterno_mi2024.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75970000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"Format string too long\" (Indicator: \"format \"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-407","level":"informative","mitre_attack_id":"T1561.001","name":"Contains ability to format disks","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Observed function \"Process.get_StartInfo\" in \"is-D7NRE.tmp\"\n Observed function \"Process.Start\" in \"is-D7NRE.tmp\"\n Observed function \"Process.get_StartInfo\" in \"is-GBLD8.tmp\"\n Observed function \"Process.Start\" in \"is-GBLD8.tmp\"\n Observed function \"Process.get_StartInfo\" in \"is-6B3FL.tmp\"\n Observed function \"Process.Start\" in \"is-6B3FL.tmp\"","id":"static-111","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to start a process (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"is-GBLD8.tmp\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"is-6HN0B.tmp\"]","id":"static-118","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform crypto operations","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"mi2024_spec\" - Location: [%LOCALAPPDATA%\\Mininterno\\Global\\settings\\mi2024_spec]- [targetUID: 00000000-00007360]\n Dropped file: \"datami2024fa.db.st\" - Location: [%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\datami2024fa.db.st]- [targetUID: 00000000-00007360]\n Dropped file: \"statmi2024fa.db.ve\" - Location: [%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\statmi2024fa.db.ve]- [targetUID: 00000000-00007360]\n Dropped file: \"datami2024fa.db.vr\" - Location: [%LOCALAPPDATA%\\Mininterno\\envmi2024fa\\datami2024fa.db.vr]- [targetUID: 00000000-00007360]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$57","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-6-0047D178\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-691-0042EE48\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-694-0042EE30\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-716-004585C8\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-3010-00478000\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-3070-0048382C\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-3403-0049756C\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-4426-0047D124\n GetTickCount@KERNEL32.DLL at 00000000-00005820-4077-4588-00496780","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$58","id":"string-493","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to crypto DLLs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$59","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$5a","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$5b","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"$5c","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$5d","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$5e","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResourceA\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")","id":"string-998","level":"informative","mitre_attack_id":"T1680","name":"Able to enumerate disk drives (API string)","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" claimed CRC 0 while the actual is CRC 19056624\n \"is-D7NRE.tmp\" claimed CRC 3532214 while the actual is CRC 895238\n \"is-GBLD8.tmp\" claimed CRC 1302261 while the actual is CRC 1610631\n \"is-1CGA1.tmp\" claimed CRC 1129739 while the actual is CRC 1302261\n \"is-SKNHO.tmp\" claimed CRC 761774 while the actual is CRC 874299\n \"is-6HN0B.tmp\" claimed CRC 610660 while the actual is CRC 643863\n \"is-QG48B.tmp\" claimed CRC 362601 while the actual is CRC 393352\n \"is-LFH1M.tmp\" claimed CRC 230297 while the actual is CRC 259068\n \"is-6B3FL.tmp\" claimed CRC 244897 while the actual is CRC 230297\n \"is-LIB0D.tmp\" claimed CRC 229170 while the actual is CRC 244897\n \"is-F59M3.tmp\" claimed CRC 197244 while the actual is CRC 167129\n \"is-DQ038.tmp\" claimed CRC 125903 while the actual is CRC 97597\n \"is-LEN3M.tmp\" claimed CRC 54525 while the actual is CRC 67512\n \"is-FK8E2.tmp\" claimed CRC 50368 while the actual is CRC 54525","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"\"mininterno_mi2024.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007360)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007280.00000001.134794.72F57000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005856.00000002.78832.0040B000.00000004.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-387-0042E394\n LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-1082-0044FD73\n LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-1094-0044C73C\n LoadLibraryExA@KERNEL32.DLL at 00000000-00005820-4077-1174-0044852C\n LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-3420-004645F4\n LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-3421-0044B658\n LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-3435-0041F118\n LoadLibraryA@KERNEL32.DLL at 00000000-00005820-4077-4451-004502C0","id":"stream-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically load libraries","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"\"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$5f","id":"api-162","level":"informative","mitre_attack_id":"T1036","name":"Renames files","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Handle: 584)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\Mininterno_mi2024.exe\" (Handle: 1120)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$60","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$61","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"$62","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed function \"System.IO.Compression.GZipStream\" in \"is-D7NRE.tmp\"\n Observed function \"System.IO.Compression.GZipStream\" in \"is-GBLD8.tmp\"","id":"static-116","level":"informative","mitre_attack_id":"T1560.002","name":"Contains ability to decompress content at runtime","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$63","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-190","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to query information about shared network resources (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$64","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-222","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve network parameters of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" with commandline \"/SL5=\"$D0180\n18723894\n214016\nC:\\\\b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\"\" (UID: 00000000-00005820)","id":"target-670","level":"informative","mitre_attack_id":"T1546.016","name":"Attempts to launch the Installer package binary","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002608.00000000.83459.00320000.00000004.mdmp, 00000000-00002608.00000001.83949.0036A000.00000004.mdmp\")","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mininterno Ministero Interno 2024\\Mininterno.net Ministero Iterno 2024.lnk\"\n \"mininterno_mi2024.exe\" touched file \"C:\\Windows\\assembly\"\n \"mininterno_mi2024.exe\" touched file \"C:\\Windows\\assembly\\Desktop.ini\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed function \"System.Reflection.Load\" in \"is-D7NRE.tmp\"\n Observed function \"System.Load\" in \"is-D7NRE.tmp\"\n Observed function \"System.Reflection.Load\" in \"is-QG48B.tmp\"","id":"static-115","level":"informative","mitre_attack_id":"T1620","name":"Dotnet code contains potential unpacker","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$65","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"mininterno_mi2024.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007360)","id":"api-110","level":"suspicious","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$66","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$67","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00005820-4077-589-0045559C","id":"stream-28","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to lookup the windows account name","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$68","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"$69","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-113","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to provide information and utilities for managing network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007360.00000001.143647.0041B000.00000002.mdmp, 00000000-00007360.00000001.143647.0D3A3000.00000002.mdmp, 00000000-00007360.00000001.143647.0D493000.00000002.mdmp, 00000000-00007360.00000001.143647.6EE23000.00000002.mdmp, 00000000-00007360.00000001.143647.6F199000.00000002.mdmp, 00000000-00007360.00000001.143647.72F1D000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-F9RJ4.tmp (UID: 00000000-00007148)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-6E1P4.tmp\\_isetup (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-6E1P4.tmp (UID: 00000000-00007280)\n \"mininterno_mi2024.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\2931a361-671f-4eb8-8eb6-b11de00a236a (UID: 00000000-00007360)","id":"api-121","level":"informative","mitre_attack_id":"T1070.004","name":"Calls an API typically used to remove a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"mininterno_mi2024.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" called \"FindResourceA\" with parameter \"11111\" - (UID: 00000000-00007148)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"FindResourceA\" with parameter \"4555836\" - (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"FindResourceA\" with parameter \"4707272\" - (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"FindResourceA\" with parameter \"83855052\" - (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"FindResourceA\" with parameter \"83859980\" - (UID: 00000000-00007280)\n \"mininterno_mi2024.exe\" called \"FindResourceA\" with parameter \"13629160\" - (UID: 00000000-00007360)\n \"mininterno_mi2024.exe\" called \"FindResourceW\" with parameter \"400\" - (UID: 00000000-00007360)\n \"mininterno_mi2024.exe\" called \"FindResourceA\" with parameter \"13617976\" - (UID: 00000000-00007360)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$6a","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$6b","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"\"1500160020730272@advapi32.dll\"\n \"0e000f00e4730272@advapi32.dll\"\n \"0e000f0050740272@advapi32.dll\"\n \"11001200d47d0272@advapi32.dll\"\n \"110012007c7e0272@advapi32.dll\"\n \"12001300cc7e0272@advapi32.dll\"\n \"12001300387f0272@advapi32.dll\"\n \"14001500e4b70272@advapi32.dll\"\n \"1400150000b80272@advapi32.dll\"\n \"140015001cb80272@advapi32.dll\"\n \"1700180038b80272@advapi32.dll\"\n \"0d000e0054b80272@advapi32.dll\"\n \"1100120064b80272@advapi32.dll\"\n \"110012007cb80272@advapi32.dll\"\n \"0d000e009c7f0272@shell32.dll\"\n \"0d000e0028800272@shell32.dll\"\n \"0f001000ecb90272@advapi32.dll\"\n \"1400150038ba0272@advapi32.dll\"\n \"1400150054ba0272@advapi32.dll\"\n \"0c000d00a8ba0272@advapi32.dll\"\n \"0c000d00b8ba0272@advapi32.dll\"\n \"0e000f00c8ba0272@advapi32.dll\"\n \"0e000f00dcba0272@advapi32.dll\"\n \"0b000c00f0ba0272@advapi32.dll\"\n \"180019008cbd0272@RPCRT4.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-437","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to retrieve token privileges information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005820-4077-75-00457A0C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005820-4077-716-004585C8\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005820-4077-795-0046E760\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005820-4077-2739-004579C8","id":"stream-71","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to query local/system time as file time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6A9F4C6C.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$6c","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"$6d","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"\"Local\\SM0:7148:168:WilStaging_02\"\n \"SM0:7148:168:WilStaging_02\"\n \"Local\\SM0:7280:168:WilStaging_02\"\n \"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"SM0:7280:64:WilError_01\"\n \"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"DBWinMutex\"\n \"SM0:7360:168:WilStaging_02\"\n \"Local\\SM0:7360:168:WilStaging_02\"\n \"SM0:7360:64:WilError_01\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$6e","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$6f","id":"static-129","level":"informative","mitre_attack_id":"T1027","name":"Dotnet file resource with suspicious entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$70","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"mininterno_mi2024.exe\" writes a file \"C:\\Program Files (x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\xpti.dat.tmp\"","id":"api-159","level":"informative","mitre_attack_id":"T1074.001","name":"Writes log files","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$71","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" queries volume information of \"C:\\\" at 00000000-00007280-00000C15-1195812015\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" queries volume information of \"C:\\\" at 00000000-00007280-00000C15-1195992954","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005820.00000000.75056.6E5E1000.00000020.mdmp\")","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"is-GBLD8.tmp\"","id":"static-140","level":"informative","mitre_attack_id":"T1573.001","name":"Contains ability to perform symmetric crypto operations","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$72","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"$73","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$74","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75910000\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75910000\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73820000\n \"mininterno_mi2024.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75910000\n \"mininterno_mi2024.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73820000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"$75","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$76","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"mininterno_mi2024.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" for deletion\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" marked \"C:\\Program Files (x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\mininterno_mi2024.exe\" for deletion\n \"mininterno_mi2024.exe\" marked \"C:\\Program Files (x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\runtime\\components\\xpti.dat\" for deletion\n \"mininterno_mi2024.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Mininterno\\envmi2024fa\\datami2024fa.db-journal\" for deletion\n \"mininterno_mi2024.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Mininterno\\envmi2024fa\\statmi2024fa.db-journal\" for deletion\n \"mininterno_mi2024.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Mininterno\\envmi2024fef\\datami2024fef.db-journal\" for deletion\n \"mininterno_mi2024.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Mininterno\\envmi2024fef\\statmi2024fef.db-journal\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"is-D7NRE.tmp\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"is-D7NRE.tmp\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"is-GBLD8.tmp\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"is-QG48B.tmp\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"is-QG48B.tmp\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"is-6B3FL.tmp\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"is-F59M3.tmp\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"is-DQ038.tmp\"","id":"static-135","level":"informative","mitre_attack_id":"T1027.002","name":"Dotnet file contains function to dynamically call methods at runtime","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"EnumWindows\" with parameter \"11530592\" - (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"EnumWindows\" with parameter \"11530584\" - (UID: 00000000-00007280)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"EnumWindows\" with parameter \"11531888\" - (UID: 00000000-00007280)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResource\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"WNetGetConnection\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")","id":"string-923","level":"informative","mitre_attack_id":"T1135","name":"Able to access Windows networking-related API (String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00005820.00000001.76978.00401000.00000020.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$77","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed function \"ResourceManager.GetObject\" in \"is-D7NRE.tmp\"\n Observed function \"ResourceManager.GetObject\" in \"is-LFH1M.tmp\"","id":"static-112","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to load content from resource","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetUserDefaultLangID@KERNEL32.DLL at 00000000-00005820-4077-2722-004560F4","id":"stream-79","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00007280.00000000.132876.004A2000.00000002.mdmp\")","id":"string-410","level":"informative","mitre_attack_id":"T1547.001","name":"References user shell folders registry key string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00005820-4077-2880-00463BF4\n GetDriveTypeA@KERNEL32.DLL at 00000000-00005820-4077-2888-00464000\n GetDriveTypeA@KERNEL32.DLL at 00000000-00005820-4077-2994-0046C514","id":"stream-66","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerates all mounted drives","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002608.00000000.83459.00320000.00000004.mdmp, 00000000-00002608.00000001.83949.0036A000.00000004.mdmp\")","id":"string-5","level":"suspicious","mitre_attack_id":"T1518.001","name":"Possibly checks for known debuggers/analysis tools","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$78","id":"api-223","level":"suspicious","mitre_attack_id":"T1070.006","name":"Calls an API typically used to query local/system time as file time","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00007148.00000000.132802.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00007148.00000000.132802.00401000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00007280.00000001.134794.00401000.00000020.mdmp\")","id":"string-553","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to modify file system redirection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$79","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$7a","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005856)\n \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5.tmp\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005820)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Observed API \"LoadLibrary\" in \"is-D7NRE.tmp\"\n Observed API \"GetAsyncKeyState\" in \"is-D7NRE.tmp\"\n Observed API \"LoadLibrary\" in \"is-F59M3.tmp\"\n Observed API \"GetProcAddress\" in \"is-F59M3.tmp\"","id":"static-126","level":"informative","mitre_attack_id":"T1106","name":"Dotnet source code contains suspicious native API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$7b","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"mininterno_mi2024.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Read system defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"Process \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (UID: 00000000-00007280) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (UID: 00000000-00007280) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$7c","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002608.00000001.83949.00781000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00005856.00000002.78832.0040B000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005856.00000002.78832.0040B000.00000004.mdmp\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"$7d","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$7e","id":"api-224","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to move file or directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-419","level":"informative","mitre_attack_id":"T1571","name":"Contains ability to open a port and listen for incoming connection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"[esc]\"; File: \"is-F59M3.tmp\")\n file/memory contains long string with (Indicator: \"[end]\"; File: \"is-OT8A4.tmp\")","id":"string-556","level":"informative","mitre_attack_id":"T1056.001","name":"Found strings related to keylogger","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$7f","id":"stream-39","level":"informative","mitre_attack_id":"T1497","name":"Makes a code branch decision directly after an API that is environment aware","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"mininterno_mi2024.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"mininterno_mi2024.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"7360\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mininterno_mi2024.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"System Security","description":"$80","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"is-HEEP8.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"is-EMSM1.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","id":"static-19","level":"informative","name":"Found Delphi 4 - Delphi 2006 artifact","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Security","description":"$81","id":"string-91","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to hook/unhook windows functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007148.00000002.136643.0040B000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000000.132876.004A2000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007280.00000000.132876.004A2000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00005820-4077-1958-00408568\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005820-4077-1962-004085B4","id":"stream-49","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query the system locale","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$82","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Able to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"is-D7NRE.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"is-D7NRE.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"is-GBLD8.tmp\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"is-GBLD8.tmp\"","id":"static-139","level":"informative","mitre_attack_id":"T1112","name":"Dotnet code contains ability to modify/delete registry","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005820.00000001.76978.0049C000.00000004.mdmp, 00000000-00005820.00000002.78904.0049C000.00000004.mdmp, 00000000-00005820.00000003.84368.0049C000.00000004.mdmp\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$83","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$84","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Able to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"$85","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"$86","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"$87","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$88","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$89","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"External Systems","description":"5/24 Antivirus vendors marked sample as malicious (20% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"SystemParametersInfoA@USER32.DLL at 00000000-00005820-4077-202-00495834\n SystemParametersInfoA@USER32.DLL at 00000000-00005820-4077-2343-00423628\n SystemParametersInfoA@USER32.DLL at 00000000-00005820-4077-2344-004235F8\n SystemParametersInfoA@USER32.DLL at 00000000-00005820-4077-2852-00462CD8","id":"stream-123","level":"suspicious","mitre_attack_id":"T1098","name":"Contains ability to update the user profile","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"set \"; File: \"is-DT74C.tmp\")","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-532","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host name of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$8a","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" with commandline \"/SL5=\"$6030C\n18723894\n214016\nC:\\\\SecuriteInfo.com.Win32.Malware- ...\" (UID: 00000000-00007280), Spawned process \"mininterno_mi2024.exe\" (UID: 00000000-00007360)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for embedded PDF matched on file \"is-HEEP8.tmp\"","id":"yara-33","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match - Embedded PDF document","origin":"YARA Signature","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"System Destruction","description":"$8b","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-f9rj4.tmp\\securiteinfo.com.win32.malware-gen.7360.1737.tmp\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" writes file \"%temp%\\is-f9rj4.tmp\\securiteinfo.com.win32.malware-gen.7360.1737.tmp\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-6e1p4.tmp\\_isetup\\_setup64.tmp\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-6e1p4.tmp\\_isetup\\_shfoldr.dll\"\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" writes file \"c:\\program files (x86)\\edena srl\\mininterno.net ministero iterno 2024\\is-emsm1.tmp\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$8c","id":"stream-3","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$8d","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$8e","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$8f","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Spyware/Information Retrieval","description":"$90","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"\"is-SKNHO.tmp\" has high imagebase \"0x78130000\"\n \"is-LIB0D.tmp\" has high imagebase \"0x6cb00000\"\n \"_setup64.tmp\" has high imagebase \"0x140000000\"","id":"static-93","level":"informative","name":"PE file has a high image base","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$91","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00005820-4077-638-004555E4\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005820-4077-2420-0042E09C\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005820-4077-3146-00478598\n OpenProcess@KERNEL32.DLL at 00000000-00005820-4077-3390-00496A34","id":"stream-31","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007280.00000000.132876.0049C000.00000004.mdmp, 00000000-00007280.00000001.134794.72F57000.00000002.mdmp, 00000000-00007280.00000002.136716.0049C000.00000004.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"General","description":"\"SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\is-F9RJ4.tmp\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" /SL5=\"$6030C\n18723894\n214016\nC:\\SecuriteInfo.com.Win32.Malware-gen.7360.1737.exe\"\" - (UID: 00000000-00007148)\n \"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Edena SRL\\Mininterno.net Ministero Iterno 2024\\mininterno_mi2024.exe\"\" - (UID: 00000000-00007280)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$92","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"},{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$93","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00005820-4077-88-00452760\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005820-4077-89-00452724","id":"stream-78","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to modify file system redirection","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a9f2bf38c77a4378b081386","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n SecuriteInfo.com.Win32.Malware-gen.7360.1737.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows\n is-EMSM1.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n is-EMSM1.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows","id":"static-97","level":"malicious","mitre_attack_id":"T1027.009","name":"PE file contains executable resources","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"SecuriteInfo.com.Win32.Malware-gen.7360.1737\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6691ca7b987b38c4160f942a","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":2,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":5,"suspicious_count":0,"total_engines":24},"mitre_attacks":{"total":102},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":290,"malicious_count":2,"suspicious_count":21,"total":313}},"summary":{"score":78,"tags":["installcore"],"verdict":"malicious"}},"metadata":{"file_info":{"compile_timestamp":"1992-06-19T22:22:17","entropy":8,"file_name":"SecuriteInfo.com.Win32.Malware-gen.7360.1737","file_size":19005600,"file_type":["compressed","innosetup"],"file_type_id":"innosetup"},"hashes":{"imphash":"884310b1928934402ea6fec1dbd3cf5e","md5":"53cb6057d8251aa5a9d00ebeafd45fc8","pehash":"0bab8542f879ee4fa6e1b3784072af219d4bc725","sha1":"c5fa88ae6c9d6048f074d6a834ae0a0a1662a4b9","sha256":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","sha512":"47a8d39eb84b4e1b0fb61b808a5ac12b92bf052ccbf33a0345f30a444589e58c237b861d3ede76d23f1aeef007f5319249ee30c57bc27b0146d27ffa15b178cd","ssdeep":"393216:Sii69b4ff1RII1gbslhZ+GYHznuCqv8yo25uNJTd+/qcmVUflAb:XlYrIZbslh9YTn3q0yPo+DmVGE","ssdeep_chunks":["393216:Sii69b4","393216:ii69b4f","393216:i69b4ff","393216:69b4ff1","393216:9b4ff1R","393216:b4ff1RI","393216:4ff1RII","393216:ff1RII1","393216:f1RII1g","393216:1RII1gb","393216:RII1gbs","393216:II1gbsl","393216:I1gbslh","393216:1gbslhZ","393216:gbslhZ+","393216:bslhZ+G","393216:slhZ+GY","393216:lhZ+GYH","393216:hZ+GYHz","393216:Z+GYHzn","393216:+GYHznu","393216:GYHznuC","393216:YHznuCq","393216:HznuCqv","393216:znuCqv8","393216:nuCqv8y","393216:uCqv8yo","393216:Cqv8yo2","393216:qv8yo25","393216:v8yo25u","393216:8yo25uN","393216:yo25uNJ","393216:o25uNJT","393216:25uNJTd","393216:5uNJTd+","393216:uNJTd+/","393216:NJTd+/q","393216:JTd+/qc","393216:Td+/qcm","393216:d+/qcmV","393216:+/qcmVU","393216:/qcmVUf","393216:qcmVUfl","393216:cmVUflA","393216:mVUflAb","786432:Sii69b4","786432:ii69b4f","786432:i69b4ff","786432:69b4ff1","786432:9b4ff1R","786432:b4ff1RI","786432:4ff1RII","786432:ff1RII1","786432:f1RII1g","786432:1RII1gb","786432:RII1gbs","786432:II1gbsl","786432:I1gbslh","786432:1gbslhZ","786432:gbslhZ+","786432:bslhZ+G","786432:slhZ+GY","786432:lhZ+GYH","786432:hZ+GYHz","786432:Z+GYHzn","786432:+GYHznu","786432:GYHznuC","786432:YHznuCq","786432:HznuCqv","786432:znuCqv8","786432:nuCqv8y","786432:uCqv8yo","786432:Cqv8yo2","786432:qv8yo25","786432:v8yo25u","786432:8yo25uN","786432:yo25uNJ","786432:o25uNJT","786432:25uNJTd","786432:5uNJTd+","786432:uNJTd+/","786432:NJTd+/q","786432:JTd+/qc","786432:Td+/qcm","786432:d+/qcmV","786432:+/qcmVU","786432:/qcmVUf","786432:qcmVUfl","786432:cmVUflA","786432:mVUflAb","393216:XlYrIZb","393216:lYrIZbs","393216:YrIZbsl","393216:rIZbslh","393216:IZbslh9","393216:Zbslh9Y","393216:bslh9YT","393216:slh9YTn","393216:lh9YTn3","393216:h9YTn3q","393216:9YTn3q0","393216:YTn3q0y","393216:Tn3q0yP","393216:n3q0yPo","393216:3q0yPo+","393216:q0yPo+D","393216:0yPo+Dm","393216:yPo+DmV","393216:Po+DmVG","393216:o+DmVGE"]},"pe_metadata":{"embedded_file_count":10,"export_count":0,"import_count":0,"imported_dlls":null,"imported_functions":null,"is_dll":false,"is_packed":false,"section_count":8,"section_names":["CODE","DATA","BSS",".idata",".tls",".rdata",".reloc",".rsrc"],"sections":[{"name":"CODE","raw_size":40448,"virtual_address":"0x1000","virtual_size":40240},{"name":"DATA","raw_size":1024,"virtual_address":"0xb000","virtual_size":592},{"name":"BSS","virtual_address":"0xc000","virtual_size":3724},{"name":".idata","raw_size":2560,"virtual_address":"0xd000","virtual_size":2384},{"name":".tls","virtual_address":"0xe000","virtual_size":8},{"name":".rdata","raw_size":512,"virtual_address":"0xf000","virtual_size":24},{"name":".reloc","virtual_address":"0x10000","virtual_size":2244},{"name":".rsrc","raw_size":168448,"virtual_address":"0x11000","virtual_size":168432}]},"submissions":{"first_seen":1720830587000,"last_multi_scan":1788816373000,"last_seen":1788816373000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6a9f2bf38c77a4378b081386","6691ca7b987b38c4160f942a"]},"schema_version":"1.0.9","sha256":"b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5","threat_score":78,"unified_at":"2026-09-16T16:59:05.679Z","unified_at_epoch_ms":1789577945679,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Riskware Sample b6faad807c27… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b6faad807c27…. Malware family: Riskware. Threat score 78/100. 5/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5"}],["$","meta","4",{"property":"og:title","content":"Malicious Riskware Sample b6faad807c27… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b6faad807c27…. Malware family: Riskware. Threat score 78/100. 5/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b6faad807c27cab32ff590fb4fe2fa99f9a63ab23e76b20875e8d47ae245e7d5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Riskware Sample b6faad807c27… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b6faad807c27…. Malware family: Riskware. Threat score 78/100. 5/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L94","11",{}]]