26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample bd4b5de1556a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bd4b5de1556a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c"],"about":{"@type":"SoftwareApplication","name":"b660803fdcc91086aa8448ddd64bf22b.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T400,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "audiodg.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "audiodg.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "audiodg.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "audiodg.exe"28:T12b4,Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") file/memory contains long string with (Indicator: "Oid"; File: "c5b4cb5e9653cc") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp")29:T8e1,Found PE header "MZ" - Source: "00000000-00000296.00000000.73746.00040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000296.00000000.73800.00040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000632.00000000.68528.012B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000632.00000001.70448.012B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000632.00000002.72369.012B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000632.00000003.73174.012B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000652.00000000.70962.00B70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000652.00000001.72885.00B70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000652.00000002.73754.00B70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001412.00000000.70543.00AC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001412.00000001.72460.00AC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001412.00000002.73730.00AC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000000.68759.00920000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000001.70679.00920000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000002.72599.00920000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000003.73705.00920000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002300.00000000.69362.00C80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002300.00000001.71282.00C80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002300.00000002.73204.00C80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002300.00000003.73697.00C80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002980.00000000.72098.00140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002980.00000001.73753.00140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003300.00000000.73488.00310000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003300.00000001.73754.00310000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003500.00000000.67707.00160000.00000004.mdmp")2a:T24fe,Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00002300-41336-905-00CE73D3 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00002300-41336-905-00CE73D3 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00002300-41336-905-00CE73D3 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00002300-41336-905-00CE73D3 Assembly shows XOR instruction xor byte ptr [00019200h] al in Stream UID: 00000000-00002300-41336-905-00CE73D3 Assembly shows XOR instruction xor eax 9A161432h in Stream UID: 00000000-00002300-41336-905-00CE73D3 Assembly shows XOR instruction xor byte ptr [0000EA00h] al in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor byte ptr [esi+edx] dl in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor eax 9A16144Fh in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor dh byte ptr [edi+73h] in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor eax 269A1614h in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor byte ptr [00022700h] al in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00002300-41336-986-00CF8B8F Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00002980-10291-905-001A73D3 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00002980-10291-905-001A73D3 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00002980-10291-905-001A73D3 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00002980-10291-905-001A73D3 Assembly shows XOR instruction xor byte ptr [00019200h] al in Stream UID: 00000000-00002980-10291-905-001A73D3 Assembly shows XOR instruction xor eax 9A161432h in Stream UID: 00000000-00002980-10291-905-001A73D3 Assembly shows XOR instruction xor byte ptr [0000EA00h] al in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor byte ptr [esi+edx] dl in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor eax 9A16144Fh in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor dh byte ptr [edi+73h] in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor eax 269A1614h in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor byte ptr [00022700h] al in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00002980-10291-986-001B8B8F Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 18233-1289-004543A9 Assembly shows XOR instruction xor eax dword ptr [ebx] in Stream UID: 18233-1289-004543A9 Assembly shows XOR instruction xor al byte ptr [ebx] in Stream UID: 18233-1289-004543A9 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 18233-1289-004543A9 Assembly shows XOR instruction xor byte ptr [esi+edx] dl in Stream UID: 18233-1145-00445A40 Assembly shows XOR instruction xor edx dword ptr [esi+edx] in Stream UID: 18233-1145-00445A40 Assembly shows XOR instruction xor byte ptr [0001B500h] al in Stream UID: 18233-1145-00445A40 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 18233-608-0045ABC3 Assembly shows XOR instruction xor byte ptr [0002C900h] al in Stream UID: 18233-608-0045ABC3 Assembly shows XOR instruction xor al byte ptr [ecx] in Stream UID: 18233-608-0045ABC3 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 18233-608-0045ABC3 Assembly shows XOR instruction xor al 14h in Stream UID: 18233-1435-00477FDF Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 18233-1447-0047A1F4 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 18233-1447-0047A1F4 Assembly shows XOR instruction xor al FEh in Stream UID: 18233-1447-0047A1F4 Assembly shows XOR instruction xor al 00h in Stream UID: 18233-1447-0047A1F4 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-1447-0047A1F4 Assembly shows XOR instruction xor dl byte ptr [esi+edx] in Stream UID: 18233-736-0041FE48 Assembly shows XOR instruction xor eax 9A161437h in Stream UID: 18233-736-0041FE48 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-736-0041FE48 Assembly shows XOR instruction xor dword ptr [ebx] eax in Stream UID: 18233-816-00409AFB Assembly shows XOR instruction xor byte ptr [00022E00h] al in Stream UID: 18233-1416-00473813 Assembly shows XOR instruction xor edx dword ptr [eax] in Stream UID: 18233-1385-0046BEA4 Assembly shows XOR instruction xor al 10h in Stream UID: 18233-1385-0046BEA4 Assembly shows XOR instruction xor byte ptr [00019800h] al in Stream UID: 18233-821-00408514 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-619-00455759 Assembly shows XOR instruction xor eax 3A040003h in Stream UID: 18233-619-00455759 Assembly shows XOR instruction xor dword ptr [edx+55h] 269A1614h in Stream UID: 18233-619-00455759 Assembly shows XOR instruction xor edx dword ptr [esi+edx] in Stream UID: 18233-1007-004314CC Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 18233-1007-004314CC Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 18233-1486-00481A59 Assembly shows XOR instruction xor dword ptr [edx] eax in Stream UID: 18233-1486-00481A59 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 18233-1486-00481A59 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 18233-681-0042C928 Assembly shows XOR instruction xor byte ptr [esi+edx] dl in Stream UID: 18233-681-0042C928 Assembly shows XOR instruction xor dword ptr [esi+edx] edx in Stream UID: 18233-681-0042C928 Assembly shows XOR instruction xor dl byte ptr [esi+edx] in Stream UID: 18233-1132-00442E3A Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-1132-00442E3A Assembly shows XOR instruction xor byte ptr [edx] cl in Stream UID: 18233-1132-00442E3A Assembly shows XOR instruction xor dword ptr [edx] ecx in Stream UID: 18233-1132-00442E3A Assembly shows XOR instruction xor al FFh in Stream UID: 18233-1132-00442E3A Assembly shows XOR instruction xor eax dword ptr [ecx] in Stream UID: 18233-1132-00442E3A Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-1-0058DD1E Assembly shows XOR instruction xor byte ptr [esi+14h] dl in Stream UID: 18233-1-0058DD1E Assembly shows XOR instruction xor dl byte ptr [ecx+14h] in Stream UID: 18233-1-0058DD1E Assembly shows XOR instruction xor edx dword ptr [esi+edx] in Stream UID: 18233-1-0058DD1E Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 18233-972-00429B21 Assembly shows XOR instruction xor eax A9000000h in Stream UID: 18233-972-00429B21 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 18233-679-0042D930 Assembly shows XOR instruction xor byte ptr [esi+edx] dl in Stream UID: 18233-679-0042D930 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-679-0042D930 Assembly shows XOR instruction xor bh ah in Stream UID: 18233-1097-004394D2 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 18233-1097-004394D2 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 18233-1097-004394D2 Assembly shows XOR instruction xor eax 16144365h in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor byte ptr [002A0600h] cl in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor byte ptr [esi+edx] dl in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor dword ptr [edi+14h] eax in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor dword ptr [esi+edx] edx in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor dword ptr [eax] edx in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor al 10h in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor edx dword ptr [eax] in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 18233-1377-0046B49B Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 18233-1319-0045DF50 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 18233-1319-0045DF50 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 18233-1319-0045DF50 Assembly shows XOR instruction xor byte ptr [00029B00h] al in Stream UID: 18233-1319-0045DF50 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 18233-1319-0045DF502b:T646,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decrypt/decode data Matched sigs: YARA signature match - AES Encryption2c:T4fa,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003500) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003500)2d:T4ef,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AutoIt3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "lsm.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "conhost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dwm.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "OSPPSVC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "csrss.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "services.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dllhost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:T41e,Found reference to API "GetLastAccessTime" (Indicator: "GetLastAccessTime"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetLastWriteTime" (Indicator: "GetLastWriteTime"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetCreationTime" (Indicator: "GetCreationTime"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetLastAccessTime" (Indicator: "GetLastAccessTime"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "GetLastWriteTime" (Indicator: "GetLastWriteTime"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "GetCreationTime" (Indicator: "GetCreationTime"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp")2f:T11fc,".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\AutoIt3.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location %PROGRAMFILES%\HNC\HShow80\HtmlExpRes\Enu\lsm.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Temp\conhost.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\AutoIt3.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location %PROGRAMFILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\lsm.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\explorer.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location %PROGRAMFILES%\Wireshark\wimaxasncp\dwm.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\OSPPSVC.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\MSOCache\All Users\csrss.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\share\AutoIt3.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\winlogon.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\analysis\0\AutoIt3.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\analysis\0\WmiPrvSE.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\VxStream\netmon\AutoIt3.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\conhost.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location %WINDIR%\CSC\winlogon.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Temp\smss.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location %USERPROFILE%\Pictures\wininit.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\audiodg.exe (UID: 00000000-00003500) ".exe" called "CopyFileW" to copy C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to new location %USERPROFILE%\AutoIt3.exe (UID: 00000000-00003500)30:T2078,Found reference to API (Indicator: "CreateDirectory"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "Sleep"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetParent"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "MessageBox"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "CloseHandle"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "DestroyIcon"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "DeleteObject"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "SelectObject"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "BitBlt"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "CreateDC"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "DeleteDC"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "SetCursorPos"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "QueryFullProcessImageName"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetCursorInfo"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "CopyIcon"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetIconInfo"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetWindowText"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "SendInput"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "SuspendThread"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "ResumeThread"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "OpenThread"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "GetTempPath"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "CreateDC"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "CopyIcon"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp")31:T6b9,Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "audiodg.exe" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "audiodg.exe" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "audiodg.exe" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "audiodg.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "audiodg.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "audiodg.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "audiodg.exe"32:Tb2c,Observed unmanaged function "EnumDisplaySettings" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "GetMessageExtraInfo" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "CloseHandle" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "DestroyIcon" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "DeleteObject" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "SelectObject" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "CreateCompatibleDC" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "GetDesktopWindow" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "BitBlt" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "CreateDC" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "DeleteDC" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "SetCursorPos" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "mouse_event" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "QueryFullProcessImageName" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "GetCursorInfo" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "CopyIcon" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "GetIconInfo" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "GetForegroundWindow" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "GetWindowText" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "waveInGetNumDevs" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "waveInGetDevCaps" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "SendInput" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "SuspendThread" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed unmanaged function "ResumeThread" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin"33:Tacd,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0" (Indicator: "mozilla/5.0 ("; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin")34:T94b,"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "audiodg.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"35:T4b0,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "AutoIt3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "AutoIt3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AutoIt3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "services.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "services.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")36:T1abc,"audiodg.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\audiodg.exe]- [targetUID: 00000000-00003500] "hosts" has type "ASCII text with CRLF LF line terminators"- Location: [%WINDIR%\System32\drivers\etc\hosts]- [targetUID: 00000000-00003500] "69ddcba757bf72" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Temp\69ddcba757bf72]- [targetUID: 00000000-00003500] "101b941d020240" has type "ASCII text with very long lines with no line terminators"- Location: [%PROGRAMFILES%\HNC\HShow80\HtmlExpRes\Enu\101b941d020240]- [targetUID: 00000000-00003500] "7a0fd90576e088" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\7a0fd90576e088]- [targetUID: 00000000-00003500] "1610b97d3ab4a7" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\1610b97d3ab4a7]- [targetUID: 00000000-00003500] "088424020bedd6" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\088424020bedd6]- [targetUID: 00000000-00003500] "3e08e1438d1124" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\3e08e1438d1124]- [targetUID: 00000000-00003500] "3e08e1438d1124" has type "ASCII text with very long lines with no line terminators"- Location: [%USERPROFILE%\3e08e1438d1124]- [targetUID: 00000000-00003500] "42af1c969fbb7b" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\42af1c969fbb7b]- [targetUID: 00000000-00003500] "56085415360792" has type "ASCII text with very long lines with no line terminators"- Location: [%USERPROFILE%\Pictures\56085415360792]- [targetUID: 00000000-00003500] "5940a34987c991" has type "ASCII text with very long lines with no line terminators"- Location: [C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\5940a34987c991]- [targetUID: 00000000-00003500] "cc11b995f2a76d" has type "ASCII text with very long lines with no line terminators"- Location: [%WINDIR%\CSC\cc11b995f2a76d]- [targetUID: 00000000-00003500] "c5b4cb5e9653cc" has type "ASCII text with very long lines with no line terminators"- Location: [C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\c5b4cb5e9653cc]- [targetUID: 00000000-00003500] "cc11b995f2a76d" has type "ASCII text with very long lines with no line terminators"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\cc11b995f2a76d]- [targetUID: 00000000-00003500] "6cb0b6c459d5d3" has type "ASCII text with very long lines with no line terminators"- Location: [%PROGRAMFILES%\Wireshark\wimaxasncp\6cb0b6c459d5d3]- [targetUID: 00000000-00003500] "088424020bedd6" has type "ASCII text with no line terminators"- Location: [C:\Temp\088424020bedd6]- [targetUID: 00000000-00003500] "3e08e1438d1124" has type "ASCII text with no line terminators"- Location: [C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\3e08e1438d1124]- [targetUID: 00000000-00003500] "886983d96e3d3e" has type "ASCII text with no line terminators"- Location: [C:\MSOCache\All Users\886983d96e3d3e]- [targetUID: 00000000-00003500] "101b941d020240" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\101b941d020240]- [targetUID: 00000000-00003500] "services.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe]- [targetUID: 00000000-00003500] "lsm.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\lsm.exe]- [targetUID: 00000000-00003500] "explorer.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\explorer.exe]- [targetUID: 00000000-00003500] "dllhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe]- [targetUID: 00000000-00003500] "dwm.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\Wireshark\wimaxasncp\dwm.exe]- [targetUID: 00000000-00001412] "winlogon.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\winlogon.exe]- [targetUID: 00000000-00003500] "wininit.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\Pictures\wininit.exe]- [targetUID: 00000000-00003500] "AutoIt3.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\AutoIt3.exe]- [targetUID: 00000000-00000632] "csrss.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\csrss.exe]- [targetUID: 00000000-00003500] "AutoIt3.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\AutoIt3.exe]- [targetUID: 00000000-00000632] "OSPPSVC.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\OSPPSVC.exe]- [targetUID: 00000000-00000652] "conhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\conhost.exe]- [targetUID: 00000000-00003500] "winlogon.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\CSC\winlogon.exe]- [targetUID: 00000000-00003500] "lsm.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\HNC\HShow80\HtmlExpRes\Enu\lsm.exe]- [targetUID: 00000000-00003500] "AutoIt3.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\AutoIt3.exe]- [targetUID: 00000000-00000632] "smss.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Temp\smss.exe]- [targetUID: 00000000-00003500] "conhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Temp\conhost.exe]- [targetUID: 00000000-00003500]37:T689,".exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "")38:T748,".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")39:T5c1,".exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.security\93d03eb9812405fa70e89d4efd5f7e14\system.security.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"3a:T6f5,".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to touch file "C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe.config" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\VERSION.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"3b:T822,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\System32\drivers\etc\hosts" ".exe" touched file "C:\Windows\CSC\winlogon.exe" ".exe" touched file "C:\Windows\CSC\cc11b995f2a76d" "AutoIt3.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "AutoIt3.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "AutoIt3.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "AutoIt3.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "AutoIt3.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "lsm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "lsm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "lsm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "lsm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "lsm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "conhost.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "conhost.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "conhost.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "conhost.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "conhost.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "dwm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "dwm.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"3c:T73e,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\RpcRtRemote.dll" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL"3d:T6b6,".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\qqyDUEYvP5Aa18d56e6#\" ".exe" trying to access non-existent file "C:\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.INI" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\BD4B5DE1556AAE6D4E52CB29392E9B4DB3AAA151E76045E28F3E69D920B4943C.EXE.CONFIG" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\1A2247EA62E93E" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\QQYDUEYVP5AA18D56E6#" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\BD4B5DE1556AAE6D4E52CB29392E9B4DB3AAA151E76045E28F3E69D920B4943C.INI" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\analysis\0\" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "AutoIt3.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local"3e:T4d3,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "audiodg.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "audiodg.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "audiodg.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "audiodg.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "audiodg.exe"3f:T7e8,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "audiodg.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "audiodg.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "audiodg.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "audiodg.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "audiodg.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "audiodg.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "audiodg.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "audiodg.exe"40:Tfe8,Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00000632.00000001.70448.03050000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000632.00000002.72369.001A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\autoit3.exe.configc:\recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\autoit3.exe.configfile:///c:/recovery/cf812052-d863-11e7-ae2b-a9d1a6f40333/autoit3.exec:/recovery/cf812052-d863-11e7-ae2b-a9d1a6f40333/autoit3.exec:\recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\autoit3.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00000632.00000002.72369.02050000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000632.00000002.72369.02050000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000632.00000002.72369.02050000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00000632.00000002.72369.03050000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000632.00000003.73174.001A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\autoit3.exe.configc:\recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\autoit3.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00000632.00000003.73174.02050000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000632.00000003.73174.02050000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00000632.00000003.73174.03050000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002300.00000001.71282.02E30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002300.00000002.73204.00050000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\temp\conhost.exe.configc:\temp\conhost.exe.configfile:///c:/temp/conhost.exec:/temp/conhost.exec:\temp\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00002300.00000002.73204.01E30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002300.00000002.73204.01E30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002300.00000002.73204.01E30000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002300.00000002.73204.02E30000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\temp\conhost.exe.configc:\temp\conhost.exe.configfile:///c:/temp/conhost.exec:/temp/conhost.exec:\temp\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00002300.00000003.73697.01E30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002300.00000003.73697.01E30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002300.00000003.73697.01E30000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002300.00000003.73697.02E30000.00000004.mdmp")41:T9ec,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\qqyDUEYvP5Aa18d56e6#\* (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter c9a4cbc00f690a9e3cddfc400f6e85bb (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter 0b2f69b43a576b9edcc807a30872bd91 (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter f7568d7f1b9d356f64779b4c0927cfb3 (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\* (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\* (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter 34156ebd576361035e366c9ecc5f9bd7 (UID: 00000000-00003500) ".exe" called "FindNextFileW" with parameter 93d03eb9812405fa70e89d4efd5f7e14 (UID: 00000000-00003500) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\* (UID: 00000000-00003500)42:T13a0,Found string "FromBase64String" (Indicator: "base64"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "GZipStream" (Indicator: "GzipStream"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "ToBase64String" (Indicator: "base64"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "mwsctuhnaespqqetWjU" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "LAEsIYJafWuQaNdnVmH" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "System.Security.Cryptography"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "ZipFile: {0}\n" (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "ZipFile::{0}" (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Cannot read that as a ZipFile" (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "The number of entries is 65535 or greater. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "ZipFile::Save: could not delete temp file: {0}." (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Use OpenReader() only with ZipFile." (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "You must call ZipFile.Save before calling OpenReader" (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Use Extract() only with ZipFile." (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "You must call ZipFile.Save before calling any Extract method" (Indicator: "zipfile"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "3DES-168" (Indicator: "3des"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "3DES-168" (Indicator: "3des-168"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "PKWare AES128" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "PKWare AES128" (Indicator: "aes128"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "PKWare AES192" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "PKWare AES192" (Indicator: "aes192"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "PKWare AES256" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "PKWare AES256" (Indicator: "aes256"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "3DES-112" (Indicator: "3des"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "3DES-112" (Indicator: "3des-112"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Blowfish" (Indicator: "blowfish"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Twofish" (Indicator: "twofish"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Inconsistent size (0x{0:X4}) in WinZip AES field at position 0x{1:X16}" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found string "Unexpected vendor version number (0x{0:X4}) for WinZip AES metadata at position 0x{1:X16}" (Indicator: "aes"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin")43:T53e,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp")44:T422,Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp")45:Td60,"audiodg.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\audiodg.exe]- [targetUID: 00000000-00003500] "services.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe]- [targetUID: 00000000-00003500] "lsm.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\lsm.exe]- [targetUID: 00000000-00003500] "explorer.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\explorer.exe]- [targetUID: 00000000-00003500] "dllhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe]- [targetUID: 00000000-00003500] "dwm.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\Wireshark\wimaxasncp\dwm.exe]- [targetUID: 00000000-00001412] "winlogon.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\winlogon.exe]- [targetUID: 00000000-00003500] "wininit.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\Pictures\wininit.exe]- [targetUID: 00000000-00003500] "AutoIt3.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\AutoIt3.exe]- [targetUID: 00000000-00000632] "csrss.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\MSOCache\All Users\csrss.exe]- [targetUID: 00000000-00003500] "AutoIt3.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\AutoIt3.exe]- [targetUID: 00000000-00000632] "OSPPSVC.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\OSPPSVC.exe]- [targetUID: 00000000-00000652] "conhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Recovery\cf812052-d863-11e7-ae2b-a9d1a6f40333\conhost.exe]- [targetUID: 00000000-00003500] "winlogon.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\CSC\winlogon.exe]- [targetUID: 00000000-00003500] "lsm.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\HNC\HShow80\HtmlExpRes\Enu\lsm.exe]- [targetUID: 00000000-00003500] "AutoIt3.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\AutoIt3.exe]- [targetUID: 00000000-00000632] "smss.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Temp\smss.exe]- [targetUID: 00000000-00003500] "conhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Temp\conhost.exe]- [targetUID: 00000000-00003500]46:T4f4,"5.15.2.0" "127.0.0.1" Potential IP "102.54.94.97" found in string "# 102.54.94.97 rhino.acme.com # source server" Potential IP "38.25.63.10" found in string "# 38.25.63.10 x.acme.com # x client host" Potential IP "127.0.0.1" found in string "#127.0.0.1 localhost" Potential IP "127.0.0.1" found in string "malwarebytes.com 127.0.0.1" Potential IP "127.0.0.1" found in string "www.malwarebytes.com 127.0.0.1" Potential IP "127.0.0.1" found in string "kaspersky.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "www.kaspersky.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "www.avast.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "avast.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "softportal.com 127.0.0.1" Potential IP "127.0.0.1" found in string "www.softportal.com 127.0.0.1" Potential IP "127.0.0.1" found in string "github.com 127.0.0.1" Potential IP "127.0.0.1" found in string "pro32.com 127.0.0.1" Potential IP "127.0.0.1" found in string "esetnod32.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "www.esetnod32.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "www.comss.ru 127.0.0.1" Potential IP "127.0.0.1" found in string "comss.ru 127.0.0.1"47:T5fe,System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-600014b-pfUO2KvWOtPOolfDMV~LNsoNX89xXpGh92wFGi System.Diagnostics.Process::GetProcessesByName(System.String) at b660803fdcc91086aa8448ddd64bf22b-60004ec-P2ganMLsX0gEpokQK8P~USBvtmniL47JbONYlEx System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-6000134-ctor System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-600011f-ctor System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-6000115-au7QjN0kwH4BqEj6qA~K8VNgHYNI9Oo62UN4Wv System.Diagnostics.Process::GetProcessesByName(System.String) at b660803fdcc91086aa8448ddd64bf22b-6000394-ctor System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-6000138-PKNcwOfe67wyRrBEiD~Kwqva8Yidawgt5HSd9r System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-6000147-ctor System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-6000123-G3mhctiooNVdnvx0Sf~jgVh9PYQCBu6ujfYwOk System.Diagnostics.Process::GetProcessesByName(System.String) at b660803fdcc91086aa8448ddd64bf22b-6000398-oTJ7QcWgUkUXkTgXOjx~OaLPy2T5QenEddiXsk8 System.Diagnostics.Process::GetProcessById(System.Int32) at b660803fdcc91086aa8448ddd64bf22b-60000f2-ctor System.Diagnostics.Process::GetProcessesByName(System.String) at b660803fdcc91086aa8448ddd64bf22b-60004d1-P2ganMLsX0gEpokQK8P~y27ULRIiJJ48:Ta7e,".exe" wrote bytes "4b1706c2" to virtual address "0x6878F798" (part of module "CLR.DLL") ".exe" wrote bytes "db4d596900000000" to virtual address "0x003E2000" (part of module "BD4B5DE1556AAE6D4E52CB29392E9B4DB3AAA151E76045E28F3E69D920B4943C.EXE") "AutoIt3.exe" wrote bytes "d5097911" to virtual address "0x6878F798" (part of module "CLR.DLL") "AutoIt3.exe" wrote bytes "db4d596900000000" to virtual address "0x012B2000" (part of module "AUTOIT3.EXE") "lsm.exe" wrote bytes "db4d596900000000" to virtual address "0x00922000" (part of module "LSM.EXE") "conhost.exe" wrote bytes "db4d596900000000" to virtual address "0x00C82000" (part of module "CONHOST.EXE") "explorer.exe" wrote bytes "e9aa6f7cf2" to virtual address "0x76D852D1" ("LoadLibraryExW@KERNEL32.DLL") "explorer.exe" wrote bytes "e9d9ce7cf2" to virtual address "0x76D802D2" ("Process32NextW@KERNEL32.DLL") "explorer.exe" wrote bytes "e964e577f2" to virtual address "0x76DD04D7" ("RemoveDirectoryA@KERNEL32.DLL") "explorer.exe" wrote bytes "e928d177f2" to virtual address "0x76DD0313" ("CreateRemoteThread@KERNEL32.DLL") "explorer.exe" wrote bytes "e926637af2" to virtual address "0x76DA8355" ("CreateDirectoryA@KERNEL32.DLL") "explorer.exe" wrote bytes "e951717af2" to virtual address "0x76DA6FCA" ("CopyFileA@KERNEL32.DLL") "explorer.exe" wrote bytes "e9b1547cf2" to virtual address "0x76D89ECA" ("LoadResource@KERNEL32.DLL") "explorer.exe" wrote bytes "e9998f7df2" to virtual address "0x76D75BC2" ("RemoveDirectoryW@KERNEL32.DLL") "explorer.exe" wrote bytes "e98e477cf2" to virtual address "0x76D8A6CD" ("FindResourceA@KERNEL32.DLL") "explorer.exe" wrote bytes "e9b9d480f2" to virtual address "0x76D42082" ("CreateProcessA@KERNEL32.DLL") "explorer.exe" wrote bytes "e97c767df2" to virtual address "0x76D76D4F" ("CopyFileW@KERNEL32.DLL") "explorer.exe" wrote bytes "e97edd80f2" to virtual address "0x76D4204D" ("CreateProcessW@KERNEL32.DLL") "explorer.exe" wrote bytes "db4d596900000000" to virtual address "0x009B2000" (part of module "EXPLORER.EXE") "explorer.exe" wrote bytes "e9e6df7bf2" to virtual address "0x76D8DE85" ("LoadLibraryA@KERNEL32.DLL") "explorer.exe" wrote bytes "e9fff47bf2" to virtual address "0x76D8CEBC" ("GetProcAddress@KERNEL32.DLL") "explorer.exe" wrote bytes "e958137df2" to virtual address "0x76D7C6B3" ("GetNativeSystemInfo@KERNEL32.DLL") "explorer.exe" wrote bytes "e9decc7cf2" to virtual address "0x76D8023D" ("Process32FirstW@KERNEL32.DLL") "explorer.exe" wrote bytes "e94d7a7cf2" to virtual address "0x76D846BE" ("LoadLibraryExA@KERNEL32.DLL") "explorer.exe" wrote bytes "e945f777f2" to virtual address "0x76DCF536" ("WinExec@KERNEL32.DLL")49:T466,"FindFirstFileW@KERNEL32.DLL" in "explorer.exe" "FindNextFileA@KERNEL32.DLL" in "explorer.exe" "FindFirstFileA@KERNEL32.DLL" in "explorer.exe" "FindNextFileW@KERNEL32.DLL" in "explorer.exe" "FindFirstFileW@KERNEL32.DLL" in "dwm.exe" "FindNextFileA@KERNEL32.DLL" in "dwm.exe" "FindFirstFileA@KERNEL32.DLL" in "dwm.exe" "FindNextFileW@KERNEL32.DLL" in "dwm.exe" "FindFirstFileW@KERNEL32.DLL" in "OSPPSVC.exe" "FindNextFileA@KERNEL32.DLL" in "OSPPSVC.exe" "FindFirstFileA@KERNEL32.DLL" in "OSPPSVC.exe" "FindNextFileW@KERNEL32.DLL" in "OSPPSVC.exe" "FindFirstFileW@KERNEL32.DLL" in "csrss.exe" "FindNextFileA@KERNEL32.DLL" in "csrss.exe" "FindFirstFileA@KERNEL32.DLL" in "csrss.exe" "FindNextFileW@KERNEL32.DLL" in "csrss.exe" "FindFirstFileW@KERNEL32.DLL" in "winlogon.exe" "FindNextFileA@KERNEL32.DLL" in "winlogon.exe" "FindFirstFileA@KERNEL32.DLL" in "winlogon.exe" "FindNextFileW@KERNEL32.DLL" in "winlogon.exe" "FindFirstFileW@KERNEL32.DLL" in "services.exe" "FindNextFileA@KERNEL32.DLL" in "services.exe" "FindFirstFileA@KERNEL32.DLL" in "services.exe" "FindNextFileW@KERNEL32.DLL" in "services.exe"4a:T6c2,55/71 Antivirus vendors marked dropped file "audiodg.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "services.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "lsm.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "explorer.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "dllhost.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "dwm.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "winlogon.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "wininit.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "AutoIt3.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "csrss.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "OSPPSVC.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "conhost.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked dropped file "smss.exe" as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate)4b:T65b,55/71 Antivirus vendors marked spawned process "AutoIt3.exe" (PID: 632) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "lsm.exe" (PID: 2188) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "conhost.exe" (PID: 2300) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "explorer.exe" (PID: 3828) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "dwm.exe" (PID: 1412) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "OSPPSVC.exe" (PID: 652) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "csrss.exe" (PID: 3588) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "winlogon.exe" (PID: 3772) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "services.exe" (PID: 2980) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "dllhost.exe" (PID: 3300) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate) 55/71 Antivirus vendors marked spawned process "AutoIt3.exe" (PID: 296) as malicious (classified as "IL:Trojan.MSILZilla" with 77% detection rate)4c:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC4d:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC4e:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC4f:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC50:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC51:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC52:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC53:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC54:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC55:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC56:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC57:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791020878006,"unified_at":"2026-10-03T09:47:58.006Z","metadata":{"hashes":{"sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","sha1":"aea447c9fd8676ad1b7ec6a42f29250a06296576","md5":"b660803fdcc91086aa8448ddd64bf22b","sha512":"1d9bb122a9979c244c2ddbcde20e5e485ab6466d35f0d75f3fb156b60ddd8ab9b9ee891fe859ad5789776cb55c9f8d09fb16005ce656bf0f99e8cd58bc7d4c6d","ssdeep":"24576:UZIagP9IN8cnzl5vAQ53FKXKC7HdlzL9z6GP+mlkPot+mPDNU/BFdXAOfCUVvdV+:Ui9koQSt6Gbjt9PDNU/BkOfCkz","ssdeep_chunks":["24576:UZIagP9","24576:ZIagP9I","24576:IagP9IN","24576:agP9IN8","24576:gP9IN8c","24576:P9IN8cn","24576:9IN8cnz","24576:IN8cnzl","24576:N8cnzl5","24576:8cnzl5v","24576:cnzl5vA","24576:nzl5vAQ","24576:zl5vAQ5","24576:l5vAQ53","24576:5vAQ53F","24576:vAQ53FK","24576:AQ53FKX","24576:Q53FKXK","24576:53FKXKC","24576:3FKXKC7","24576:FKXKC7H","24576:KXKC7Hd","24576:XKC7Hdl","24576:KC7Hdlz","24576:C7HdlzL","24576:7HdlzL9","24576:HdlzL9z","24576:dlzL9z6","24576:lzL9z6G","24576:zL9z6GP","24576:L9z6GP+","24576:9z6GP+m","24576:z6GP+ml","24576:6GP+mlk","24576:GP+mlkP","24576:P+mlkPo","24576:+mlkPot","24576:mlkPot+","24576:lkPot+m","24576:kPot+mP","24576:Pot+mPD","24576:ot+mPDN","24576:t+mPDNU","24576:+mPDNU/","24576:mPDNU/B","24576:PDNU/BF","24576:DNU/BFd","24576:NU/BFdX","24576:U/BFdXA","24576:/BFdXAO","24576:BFdXAOf","24576:FdXAOfC","24576:dXAOfCU","24576:XAOfCUV","24576:AOfCUVv","24576:OfCUVvd","24576:fCUVvdV","24576:CUVvdV+","49152:UZIagP9","49152:ZIagP9I","49152:IagP9IN","49152:agP9IN8","49152:gP9IN8c","49152:P9IN8cn","49152:9IN8cnz","49152:IN8cnzl","49152:N8cnzl5","49152:8cnzl5v","49152:cnzl5vA","49152:nzl5vAQ","49152:zl5vAQ5","49152:l5vAQ53","49152:5vAQ53F","49152:vAQ53FK","49152:AQ53FKX","49152:Q53FKXK","49152:53FKXKC","49152:3FKXKC7","49152:FKXKC7H","49152:KXKC7Hd","49152:XKC7Hdl","49152:KC7Hdlz","49152:C7HdlzL","49152:7HdlzL9","49152:HdlzL9z","49152:dlzL9z6","49152:lzL9z6G","49152:zL9z6GP","49152:L9z6GP+","49152:9z6GP+m","49152:z6GP+ml","49152:6GP+mlk","49152:GP+mlkP","49152:P+mlkPo","49152:+mlkPot","49152:mlkPot+","49152:lkPot+m","49152:kPot+mP","49152:Pot+mPD","49152:ot+mPDN","49152:t+mPDNU","49152:+mPDNU/","49152:mPDNU/B","49152:PDNU/BF","49152:DNU/BFd","49152:NU/BFdX","49152:U/BFdXA","49152:/BFdXAO","49152:BFdXAOf","49152:FdXAOfC","49152:dXAOfCU","49152:XAOfCUV","49152:AOfCUVv","49152:OfCUVvd","49152:fCUVvdV","49152:CUVvdV+","24576:Ui9koQS","24576:i9koQSt","24576:9koQSt6","24576:koQSt6G","24576:oQSt6Gb","24576:QSt6Gbj","24576:St6Gbjt","24576:t6Gbjt9","24576:6Gbjt9P","24576:Gbjt9PD","24576:bjt9PDN","24576:jt9PDNU","24576:t9PDNU/","24576:9PDNU/B","24576:PDNU/Bk","24576:DNU/BkO","24576:NU/BkOf","24576:U/BkOfC","24576:/BkOfCk","24576:BkOfCkz"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"b660803fdcc91086aa8448ddd64bf22b.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1636352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1694256309000,"last_seen":1694256471000,"last_multi_scan":1694256471000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":137,"suspicious_count":12,"malicious_count":12,"total":161},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.FUJL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1323984","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.21460","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Msilmamut-9950860-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.21460 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.DTP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 0058ec321 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.MSIL.DCRat.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FUJL!B660803FDCC9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DCRat-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.LQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.BasicGen.Win32.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.MSILZilla","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve system time"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Copy files into temp folder"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"malicious","value":"Writes to the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"System.IO.Compression.GZipStream\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$27","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform code compilation at runtime (Dotnet)","description":"Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.004","relevance":1,"id":"static-174","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetCreationTimeUtc\" (Indicator: \"SetCreationTime\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")\n Found reference to API \"SetLastAccessTimeUtc\" (Indicator: \"SetLastAccessTime\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")\n Found reference to API \"SetLastWriteTimeUtc\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")\n Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"System.Reflection.Load\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"System.Load\" in \"audiodg.exe\"\n Observed function \"System.Reflection.Load\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"audiodg.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"audiodg.exe\"\n Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"audiodg.exe\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"audiodg.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin has big resource with name: \"wO6wOm2Cq0ewHqqD5u.kLOjaCJHDqGL1jLG1s\" size: \"833420\" and abnormal entropy:\"7.99975759029\"\n audiodg.exe has big resource with name: \"wO6wOm2Cq0ewHqqD5u.kLOjaCJHDqGL1jLG1s\" size: \"833420\" and abnormal entropy:\"7.99975759029\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$29","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"ToBase64String\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"FromBase64String\" in \"audiodg.exe\"\n Observed function \"ToBase64String\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.Bad length during Decryption: the length parameter must be smaller than or equal to the size of the destination array.\" in Source: 6000fb9-IxOHJ2pLxLKPOEyp5wO~IY9YmBfjTa","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"audiodg.exe\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"audiodg.exe\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.300232803443906","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3500\" - (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\".exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"a01f6eeebd4a5ce96afeeb2f58d811f52645ddad\" - (UID: 00000000-00003500)\n \"AutoIt3.exe\" called \"OpenMutexW\" with parameter \"a01f6eeebd4a5ce96afeeb2f58d811f52645ddad\" - (UID: 00000000-00000632)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\".exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003500)\n \"AutoIt3.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00000632)\n \"conhost.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002300)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Indicator: \"select * from \"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_OSVersion\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_Is64BitOperatingSystem\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_MachineName\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_UserName\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_Version\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_SystemDirectory\" in \"audiodg.exe\"\n Observed function \"get_OSVersion\" in \"audiodg.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"audiodg.exe\"\n Observed function \"get_MachineName\" in \"audiodg.exe\"\n Observed function \"get_UserName\" in \"audiodg.exe\"\n Observed function \"get_Version\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at b660803fdcc91086aa8448ddd64bf22b-60000ff-au7QjN0kwH4BqEj6qA~xaaoCPYZrtU33PEfkfa\n System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) at b660803fdcc91086aa8448ddd64bf22b-60000f2-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"geoplugin_countryCode\" (Indicator: \"countrycode\") in Source: 6000689-hGWSbUjUpVG3jeOP1cR~qKw2xR6Xjp","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system time","description":"Found string \"@echo off\\r\\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\\r\\ncd \\\"\" (Indicator: \"w32tm \"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"), Found string \"@echo off\\r\\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"w32tm \"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found string \"@echo off\\r\\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"w32tm \"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe\" at 00000000-00003500-0000010C-2080592\n \"AutoIt3.exe\" queries volume information of \"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\AutoIt3.exe\" at 00000000-00000632-0000010C-11123995","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AutoIt3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"conhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"AutoIt3.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"conhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$2f","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003500)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003500)\n \"AutoIt3.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00000632)\n \"AutoIt3.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00000632)\n \"conhost.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002300)\n \"conhost.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002300)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Source: 60004ce-P2ganMLsX0gEpokQK8P~GaijzulTJ7, Indicator: \"select * from win32_pnpentity where (pnpclass = 'image' or pnpclass = 'camera')\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"audiodg.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"audiodg.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"set_UseShellExecute\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$31","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"Process.Start\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" in Source: 600040d-b3dMOXLLcNiXSySN2f1l2TbDSLUWxVgPdF1T0B~hnYLAKbtU7\n \"Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\" in Source: 600040d-b3dMOXLLcNiXSySN2f1l2TbDSLUWxVgPdF1T0B~hnYLAKbtU7\n \"HKEY_CLASSES_ROOT\\\\tdesktop.tg\\\\shell\\\\open\\\\command\" in Source: 60004d1-P2ganMLsX0gEpokQK8P~y27ULRIiJJ\n \"SOFTWARE\\\\Valve\\\\Steam\" in Source: 60004d3-P2ganMLsX0gEpokQK8P~mu0UUke2WJ\n \"Software\\\\\\\\\" in Source: 6000703-S80LbRjmTmgNT18sljj~g8ACYp58vR\n \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\" in Source: 6000744-cctor\n \"SOFTWARE\\\\Microsoft\\\\NET Framework Setup\\\\NDP\\\\v4\\\\Full\\\\\" in Source: 600079a-BYAo2Gj82f4NQco5xOT~HbX5HYRXar","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\".exe\" copies C:\\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to temp folder C:\\Temp\\conhost.exe (UID: 00000000-00003500)\n \".exe\" copies C:\\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe to temp folder C:\\Temp\\smss.exe (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\a01f6eeebd4a5ce96afeeb2f58d811f52645ddad\"\n \"Local\\a01f6eeebd4a5ce96afeeb2f58d811f52645ddad\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"audiodg.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"audiodg.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"audiodg.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"audiodg.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"audiodg.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$32","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"github.com 127.0.0.1\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67370000\n \"AutoIt3.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67370000\n \"conhost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67370000\n \"services.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67370000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DE0000\n \"AutoIt3.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DE0000\n \"conhost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 67FD0000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000\n \"AutoIt3.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000\n \"lsm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000\n \"conhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000\n \"dwm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000\n \"OSPPSVC.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000\n \"services.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68780000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"AutoIt3.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"lsm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"conhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"dwm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"OSPPSVC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"csrss.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"winlogon.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"services.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000\n \"dllhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76E20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" was detected as \".NET\" and name: \"Library\"\n \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"audiodg.exe\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"audiodg.exe\" was detected as \".NET\" and name: \"Library\"\n \"audiodg.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"audiodg.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Source: 60004ce-P2ganMLsX0gEpokQK8P~GaijzulTJ7, Indicator: \"select * from win32_pnpentity where (pnpclass = 'image' or pnpclass = 'camera')\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\LOCALSERVER32\")\n \".exe\" touched \"WbemDefaultPathParser\" (Path: \"HKCU\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\INPROCSERVER32\")\n \".exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\INPROCSERVER32\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \".exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \".exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKCU\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")\n \".exe\" touched \"WbemStatusCode\" (Path: \"HKCU\\CLSID\\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"audiodg.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" has an executable section named \".text\"\n \"audiodg.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" has an writable section named \".sdata\"\n \"audiodg.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$34","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x18be00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x18bd24\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\")\\r\\nAntivirus:\" (Indicator: \"antivirus\") in Source: 600058b-gwiCASL9tfkrkFBYBy8MFtVVnLMp9Il8FDMQft~rE8q3QCZeW\n \"Antivirus\" (Indicator: \"antivirus\") in Source: 600058b-gwiCASL9tfkrkFBYBy8MFtVVnLMp9Il8FDMQft~rE8q3QCZeW","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\CSC\\winlogon.exe\" [Source: 00000000-00003500-00000C37-92073400593]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$35","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"text/javascript\" (Indicator: \"text/javascript\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00003500-00000C28-389199888]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AutoIt3.exe\" (UID: 00000000-00000632)\n Spawned process \"lsm.exe\" (UID: 00000000-00002188)\n Spawned process \"conhost.exe\" (UID: 00000000-00002300)\n Spawned process \"explorer.exe\" (UID: 00000000-00003828)\n Spawned process \"dwm.exe\" (UID: 00000000-00001412)\n Spawned process \"OSPPSVC.exe\" (UID: 00000000-00000652)\n Spawned process \"csrss.exe\" (UID: 00000000-00003588)\n Spawned process \"winlogon.exe\" (UID: 00000000-00003772)\n Spawned process \"services.exe\" (UID: 00000000-00002980)\n Spawned process \"dllhost.exe\" (UID: 00000000-00003300)\n Spawned process \"AutoIt3.exe\" (UID: 00000000-00000296)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AutoIt3.exe\" (UID: 00000000-00000632)\n Spawned process \"lsm.exe\" (UID: 00000000-00002188)\n Spawned process \"conhost.exe\" (UID: 00000000-00002300)\n Spawned process \"explorer.exe\" (UID: 00000000-00003828)\n Spawned process \"dwm.exe\" (UID: 00000000-00001412)\n Spawned process \"OSPPSVC.exe\" (UID: 00000000-00000652)\n Spawned process \"csrss.exe\" (UID: 00000000-00003588)\n Spawned process \"winlogon.exe\" (UID: 00000000-00003772)\n Spawned process \"services.exe\" (UID: 00000000-00002980)\n Spawned process \"dllhost.exe\" (UID: 00000000-00003300)\n Spawned process \"AutoIt3.exe\" (UID: 00000000-00000296)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"audiodg.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\".exe\" writes to a file \"C:\\Temp\\conhost.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"AutoIt3.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$36","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Temp\\088424020bedd6\" (UID: 3500)\n \".exe\" queries basic process information of the \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\3e08e1438d1124\" (UID: 3500)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\".exe\" touched file \"C:\\Program Files\\HNC\\HShow80\\HtmlExpRes\\Enu\\lsm.exe\"\n \".exe\" touched file \"C:\\Program Files\\HNC\\HShow80\\HtmlExpRes\\Enu\\101b941d020240\"\n \".exe\" touched file \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\lsm.exe\"\n \".exe\" touched file \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\101b941d020240\"\n \".exe\" touched file \"C:\\Program Files\\Wireshark\\wimaxasncp\\dwm.exe\"\n \".exe\" touched file \"C:\\Program Files\\Wireshark\\wimaxasncp\\6cb0b6c459d5d3\"\n \"lsm.exe\" touched file \"C:\\Program Files\\HNC\\HShow80\\HtmlExpRes\\Enu\\lsm.exe.config\"\n \"dwm.exe\" touched file \"C:\\Program Files\\Wireshark\\wimaxasncp\\dwm.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\windows\\system32\\drivers\\etc\\hosts\"\n \".exe\" writes file \"c:\\recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\autoit3.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\".exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003500)\n \"AutoIt3.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000632)\n \"conhost.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002300)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed namespace \"System.Net.Sockets\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--{0}\\r\\nContent-Disposition: form-data; name=\\\"{1}\\\"; filename=\\\"{2}\\\";\\r\\nContent-Type: {3}\\r\\n\\r\\n\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found string \"--{0}\\r\\nContent-Disposition: form-data; name=\\\"{1}\\\"\\r\\n\\r\\n{2}\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"B+(~.Pf\"\n Heuristic match: \"b+(}.Tj\"\n Pattern match: \"www.malwarebytes.com\"\n Pattern match: \"www.kaspersky.ru\"\n Pattern match: \"www.avast.ru\"\n Pattern match: \"www.softportal.com\"\n Pattern match: \"www.esetnod32.ru\"\n Pattern match: \"www.comss.ru\"\n Heuristic match: \"B+\t(~.Pf\"\n Heuristic match: \"b+\t(}.Tj\"\n Heuristic match: \"W<.Vg\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1\\r\\nHost:\" (Indicator: \"HTTP/1.1\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003500\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"AutoIt3.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"conhost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"explorer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OSPPSVC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"csrss.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"winlogon.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"audiodg.exe\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1056.001","relevance":1,"id":"static-163","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"get_ProcessName\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"GetProcessesByName\" in \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\"\n Observed function \"GetProcessById\" in \"audiodg.exe\"\n Observed function \"get_ProcessName\" in \"audiodg.exe\"\n Observed function \"GetProcessesByName\" in \"audiodg.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at b660803fdcc91086aa8448ddd64bf22b-6000797-BYAo2Gj82f4NQco5xOT~ja55mVuD5t\n System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at b660803fdcc91086aa8448ddd64bf22b-60007b0-BYAo2Gj82f4NQco5xOT~JvDI4i14KholrodjDEV","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00000296.00000000.73746.00042000.00000020.mdmp, 00000000-00000296.00000000.73800.00042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Missing password.\" (Indicator: \"password\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found string \"bad password\" (Indicator: \"password\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found string \"Supply a password to use AES encryption.\" (Indicator: \"password\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found string \"This entry requires a password.\" (Indicator: \"password\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")\n Found string \"The password did not match.\" (Indicator: \"password\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Indicator: \" Win32_PnPEntity\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\sspicli.dll\" (UID: 00000000-00003500), \"AutoIt3.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000632), \"conhost.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002300)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 600028d-ctor","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"AutoIt3.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"HOSTNAME\"; Value: \"\")\n \".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"DOMAIN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"audiodg.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"AutoIt3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"conhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc\n .text\n .reloc with unusual entropies 7.32642607312\n 0.101910425663\n 7.32642607312\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Indicator: \" win32_pnpentity\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"6/90 reputation engines marked \"http://rhino.acme.com\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"C:\\analysis\\0\\WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003500-00000C37-74892711715\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"$47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"AutoIt3.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\share\\AutoIt3.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$48","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"lsm.exe\" at non-system pathway \"%PROGRAMFILES%\\HNC\\HShow80\\HtmlExpRes\\Enu\\lsm.exe\" (UID: 00000000-00002188)\n Process \"csrss.exe\" at non-system pathway \"C:\\MSOCache\\All Users\\csrss.exe\" (UID: 00000000-00003588)\n Process \"winlogon.exe\" at non-system pathway \"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\winlogon.exe\" (UID: 00000000-00003772)\n Process \"services.exe\" at non-system pathway \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\services.exe\" (UID: 00000000-00002980)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"lsm.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00002188)\n Process \"conhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00002300)\n Process \"dwm.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00001412)\n Process \"csrss.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003588)\n Process \"winlogon.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003772)\n Process \"services.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00002980)\n Process \"dllhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003300)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks file system APIs","description":"$49","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$4a","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\" was dropped at \"%WINDIR%\\CSC\\winlogon.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Network Related","name":"Writes to the hosts file","description":"\".exe\" wrote 338 bytes to file \"C:\\Windows\\System32\\drivers\\etc\\hosts\": 0d0a6d616c7761726562797465732e636f6d203132372e302e302e310a7777772e6d616c7761726562797465732e636f6d203132372e302e302e310a6b6173706572736b792e7275203132372e302e302e310a7777772e6b6173706572736b792e7275203132372e302e302e310a7777772e61766173742e7275203132372e30 ...\n \"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe\" wrote to file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1565","relevance":10,"id":"api-32","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"explorer.exe\"\n \"send@WS2_32.DLL\" in \"dwm.exe\"\n \"send@WS2_32.DLL\" in \"OSPPSVC.exe\"\n \"send@WS2_32.DLL\" in \"csrss.exe\"\n \"send@WS2_32.DLL\" in \"winlogon.exe\"\n \"send@WS2_32.DLL\" in \"services.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00003500)\n Spawned process \"AutoIt3.exe\" (UID: 00000000-00000632)\n Spawned process \"lsm.exe\" (UID: 00000000-00002188)\n Spawned process \"conhost.exe\" (UID: 00000000-00002300)\n Spawned process \"explorer.exe\" (UID: 00000000-00003828)\n Spawned process \"dwm.exe\" (UID: 00000000-00001412)\n Spawned process \"OSPPSVC.exe\" (UID: 00000000-00000652)\n Spawned process \"csrss.exe\" (UID: 00000000-00003588)\n Spawned process \"winlogon.exe\" (UID: 00000000-00003772)\n Spawned process \"services.exe\" (UID: 00000000-00002980)\n Spawned process \"dllhost.exe\" (UID: 00000000-00003300)\n Spawned process \"AutoIt3.exe\" (UID: 00000000-00000296)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes to the hosts file"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}]},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"64fc4d57bb8699c0a80816a8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILZilla","submit_name":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe","analysis_start_time":"2023-09-09T10:47:51+00:00","indicators_count":{"informative":137,"suspicious":35,"malicious":12},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}],"processes":[{"pid":3500,"ppid":0,"name":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c.exe","uid":"00000000-00003500","icon":"$4c"},{"pid":632,"ppid":0,"name":"AutoIt3.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\AutoIt3.exe","uid":"00000000-00000632","icon":"$4d"},{"pid":2188,"ppid":0,"name":"lsm.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"%PROGRAMFILES%\\HNC\\HShow80\\HtmlExpRes\\Enu\\lsm.exe","uid":"00000000-00002188","icon":"$4e"},{"pid":2300,"ppid":0,"name":"conhost.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\Temp\\conhost.exe","uid":"00000000-00002300","icon":"$4f"},{"pid":3828,"ppid":0,"name":"explorer.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\explorer.exe","uid":"00000000-00003828","icon":"$50"},{"pid":1412,"ppid":0,"name":"dwm.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"%PROGRAMFILES%\\Wireshark\\wimaxasncp\\dwm.exe","uid":"00000000-00001412","icon":"$51"},{"pid":652,"ppid":0,"name":"OSPPSVC.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\OSPPSVC.exe","uid":"00000000-00000652","icon":"$52"},{"pid":3588,"ppid":0,"name":"csrss.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\MSOCache\\All Users\\csrss.exe","uid":"00000000-00003588","icon":"$53"},{"pid":3772,"ppid":0,"name":"winlogon.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\winlogon.exe","uid":"00000000-00003772","icon":"$54"},{"pid":2980,"ppid":0,"name":"services.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\services.exe","uid":"00000000-00002980","icon":"$55"},{"pid":3300,"ppid":0,"name":"dllhost.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\dllhost.exe","uid":"00000000-00003300","icon":"$56"},{"pid":296,"ppid":0,"name":"AutoIt3.exe","command_line":"","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","normalized_path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\AutoIt3.exe","uid":"00000000-00000296","icon":"$57"}],"all_imported_dlls":["mscoreei.dll","System.Configuration.ni.dll","bcrypt.dll","wbemsvc.dll","ntdsapi.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","rpcss.dll","ucrtbase_clr0400.dll","ws2_32.dll","usp10.dll","cryptbase.dll","ole32.dll","System.Windows.Forms.ni.dll","mscorlib.ni.dll","System.Core.ni.dll","shlwapi.dll","sspicli.dll","gdi32.dll","msctf.dll","cryptsp.dll","System.Drawing.ni.dll","rpcrt4.dll","VxSSL32.dll","wbemcomn.dll","kernel32.dll","nsi.dll","System.ni.dll","WMINet_Utils.dll","sechost.dll","clr.dll","wtsapi32.dll","wmiutils.dll","user32.dll","rsaenh.dll","shell32.dll","profapi.dll","KernelBase.dll","version.dll","clrjit.dll","nlssorting.dll","fastprox.dll","clbcatq.dll","fltLib.dll","uxtheme.dll","api-ms-win-core-xstate-l2-1-0.dll","RpcRtRemote.dll","System.Xml.ni.dll","psapi.dll","imm32.dll","ntdll.dll","mscoree.dll","advapi32.dll","System.Management.ni.dll","msvcrt.dll","lpk.dll","System.Security.ni.dll","wbemprox.dll","vcruntime140_clr0400.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"lsm.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"dwm.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"AutoIt3.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"wininit.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"winlogon.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"csrss.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"services.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"dllhost.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"OSPPSVC.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"audiodg.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"conhost.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"explorer.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"smss.exe","sha256":"bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"101b941d020240","sha256":"ce52ba9cba41105cca2df4f85845c6efe79a5e56d408c3e2278d10657e26f991","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"6cb0b6c459d5d3","sha256":"aad483c8e8034291ad1d6e0e8fb6c522b751d8e96427cea640ddcf4f2de2bd9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"3e08e1438d1124","sha256":"64854607b109776a661a26bf7af80c397135f9bdbee036b15398d626bb24c50c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"56085415360792","sha256":"69dacf74dd471bcb315b37fba818a76aa1d919839e0d753c01ac4e0bf217be87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"cc11b995f2a76d","sha256":"0c678c86cfc6c142c1eecec826f21d4f1283aa1be8e91484cc844932b2959e86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"hosts","sha256":"ef52871dc0193a3f3c8305e165cecd17e2e51be3cec3f01a84b0d2342844e848","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"886983d96e3d3e","sha256":"652cc506ff1a3a069901389021ac16f239d7fd7cade2e65a1ee6a94cc019930b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"c5b4cb5e9653cc","sha256":"906870c937fd71be5175afc239d642e806a7679482dc7a3536e7cbf49e587875","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"5940a34987c991","sha256":"f65aaa0d56284892870e0cd77c5952d3ab22e8e752540847f954f07a77fc289d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\3e08e1438d1124","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%PROGRAMFILES%\\HNC\\HShow80\\HtmlExpRes\\Enu\\101b941d020240","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Temp\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\3e08e1438d1124","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%PROGRAMFILES%\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\lsm.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%PROGRAMFILES%\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\101b941d020240","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%SAMPLEDIR%\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\7a0fd90576e088","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%PROGRAMFILES%\\Wireshark\\wimaxasncp\\6cb0b6c459d5d3","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\1610b97d3ab4a7","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\MSOCache\\All Users\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\share\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\c5b4cb5e9653cc","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%SAMPLEDIR%\\Temp\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\winlogon.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\cc11b995f2a76d","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%WINDIR%\\CSC\\winlogon.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%WINDIR%\\CSC\\cc11b995f2a76d","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%USERPROFILE%\\Pictures\\wininit.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%USERPROFILE%\\Pictures\\56085415360792","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\audiodg.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Recovery\\cf812052-d863-11e7-ae2b-a9d1a6f40333\\42af1c969fbb7b","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Temp\\smss.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"C:\\Temp\\69ddcba757bf72","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%USERPROFILE%\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"path":"%USERPROFILE%\\3e08e1438d1124","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"key":"HKCUHKCU\\SOFTWARE\\02CAD79F1E95895162D5BF875A68DD7E\\","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\a01f6eeebd4a5ce96afeeb2f58d811f52645ddad","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]},{"name":"Local\\a01f6eeebd4a5ce96afeeb2f58d811f52645ddad","sources":[{"report_type":"sandbox","report_id":"64fc4d57bb8699c0a80816a8"}]}]}},"report_ids":{"sandbox_job_ids":["64fc4d57bb8699c0a80816a8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious IL:Trojan.MSILZilla Sample bd4b5de1556a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bd4b5de1556a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.MSILZilla Sample bd4b5de1556a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bd4b5de1556a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bd4b5de1556aae6d4e52cb29392e9b4db3aaa151e76045e28f3e69d920b4943c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.MSILZilla Sample bd4b5de1556a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bd4b5de1556a…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]]