24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.WannaCryptor Sample be22645c6194… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample be22645c6194…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 23/27 AV engines flagged this file. 17 malicious and 39 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844","keywords":["Malicious","Trojan.Ransom.WannaCryptor","malware analysis","sandbox report","threat intelligence","be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844"],"about":{"@type":"SoftwareApplication","name":"download.zip","applicationCategory":["peexe","executable"],"identifier":"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.WannaCryptor","antivirusDetections":{"malicious":23,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":39},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T590,Found reference to "- bpo-40645: The :class:`hmac.HMAC` exposes internal implementation details." (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "HMAC API. The new code will be used in Python 3.10 after the internal" (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "implementation details of the pure Python HMAC module are no longer part" (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "- bpo-33604: Fixed `hmac.new` and `hmac.HMAC` to raise TypeError instead of" (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "- bpo-38134: Remove obsolete copy of PBKDF2_HMAC_fast. All supported OpenSSL" (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "- bpo-33604: Remove HMAC default to md5 marked for removal in 3.8 (removal" (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "- bpo-33604: Update HMAC md5 default to a DeprecationWarning, bump removal" (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found reference to "optimized HMAC digest." (Indicator: "HMAC"; Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp")26:T690,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" renamed original file"C:\ProgramData\Microsoft\Windows\WER\Temp\WER.1f03028b-ada9-4b97-9864-c53b003a2832.tmp.csv.WCRYT" to "%USERPROFILE%\Microsoft\Windows\WER\Temp\WER.1f03028b-ada9-4b97-9864-c53b003a2832.tmp.csv.WCRY" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" renamed original file"C:\ProgramData\Microsoft\Windows\WER\Temp\WER.752e1475-8cc0-49a3-a007-5f9791e67710.tmp.txt.WCRYT" to "%USERPROFILE%\Microsoft\Windows\WER\Temp\WER.752e1475-8cc0-49a3-a007-5f9791e67710.tmp.txt.WCRY" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" renamed original file"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.9-0\ThirdPartyNotices.txt.WCRYT" to "%USERPROFILE%\Microsoft\Windows Defender\Platform\4.18.23050.9-0\ThirdPartyNotices.txt.WCRY" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" renamed original file"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WCRYT" to "%USERPROFILE%\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WCRY" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" renamed original file"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ThirdPartyNotices.txt.WCRYT" to "%USERPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ThirdPartyNotices.txt.WCRY" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" renamed original file"C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WCRYT" to "%USERPROFILE%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WCRY"27:T560,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match - AES Encryption Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)28:T20e1,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000006d00b40f3300f0ed190065097c771200000000000000d06c767602000000f88d6d00b40f330010ee190065097c771200000000000000d06c7676f0b9f6751200000024ee1900ae2e79770200000000000000d06c767634ee1900e16c767602000000000000005cee19006820b176020000000000000037b0649c7092fe75000000009cee1900201bb676ffffffffacee19005810b1763c10b176c7b0649c7092fe759cb9f675f0b9f6758cee190088ee19000d0000000d00000050411a767cc853760000000040411a76a8ee190020ef1900608db476234bc0eafeffffffb8ee1900900fb17650411a76c8ee190006250d767cc8537650411a76d4ee1900 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003684) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000077779806480398064803000000000950777700007a7503000000065177770000000050f02f033429da76000000000000000000000000000000002048da76080000000000000050137e753429da76000000000800000098064803000000000000000000000000000000001800000013c7293e932f1b7368012f0334f02f03c8f02f03705f1b733f0a1b4efeffffff94fc7b77b0ea4703000047030000000000000000a3681a733cf02f03000000006400000011001200e84f4703000000001200000000000000b8e74703afea4703b0ea4703d84f47030000470334f02f031cf02f03a6eb7777000000000000000000000000b047da76c0029fc554f02f03 (UID: 00000000-00009660) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009660) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009660) "cscript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003532) "cscript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003532) "cscript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000006500b45f3a00d80a650054cd5800feba7777000000000000000003000000c0ab7400b45f3a0070cd580065097c771300000000000000d06c7676f0b9f6751300000084cd5800ae2e79770300000000000000d06c767694cd5800e16c76760300000000000000bccd58006820b1760300000000000000ec48da877092fe7500000000fccd5800201bb676ffffffff0cce58005810b1763c10b1765c4bda877092fe759cb9f675f0b9f675eccd5800e8cd58000d0000000d00000050411a767cc853760000000040411a7608ce580080ce5800608db47618903ff1feffffff18ce5800900fb17650411a7628ce580006250d767cc8537650411a7634ce5800 (UID: 00000000-00003532) "cscript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000d06c7676000000001300000000dc58007b23718fedf4dd3e0000430030dfda8950dc5800b0e87a7715050149feffffff60dc5800906c74000000637630fab573d4477777c54777779df4dd3e00dd5800c4ca7600824681db54dc580080dd5800b0acca73ffffffff94dc580072fab57380dd5800ec4ea87372fab573010000000000000002000000ec4ea873bcdc580000dd5800c4ca760080fab57300000000c4dc58007c0b787610aa8476b64681db (UID: 00000000-00003532) "cscript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000005800a0bc5800acbc58009cbc580002020000d8bc5800b005d1757ac058009002d175c105d1754cc05800ffffffff10bd580014bd580000000000a0bc5800be3977777865770000000000000000000000000000000000a22681db74bc5800c0bf5800b0acca73ffffffffb4bc580072fab5738cbc58007ccea77372fab5730100000000000000020000007ccea773e0bc58001cc358001cc6780080fab573a29475762900000090bf780000000000562681db (UID: 00000000-00003532) "cscript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000ec02740050bc580044be580000007400000000000000000000000000000000000000000000000000200000000900150058937700089b7700b1ca7777089b770000000000280000004200bb73c4bd580000000000a22681db74bc5800c0bf5800b0acca73ffffffffb4bc580072fab5738cbc58007ccea77372fab5730100000000000000020000007ccea773e0bc58001cc3580064cc780080fab573a29475762a00000020c0780000000000562681db (UID: 00000000-00003532)29:Ta81,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003684) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003532) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000f9fe720000000011000000f0f1fe72800000000000000000006f000c000000000000000000000000db5800feba77770000000000000000800000008032fe7220db58002d83677700006f0000000000800000008032fe7202000000ec13fe7238db58008b32fe7280000000b437fe7201000000a8e4fe7264db58004134fe72 (UID: 00000000-00003532) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000936e776cca58002df8fa720800000011f8fa7290106bde804cfa721020fa72020000004000fb72c8686f00c0686f0038ca58001020fa720ccb5800d0f5fa72ac45cfacfeffffff78ca580042f8fa724000fb7290ca5800944cfa724000fb72cf7b697701000000a4bbfc72bcca580041f2fa720820fa721420fa7200000000 (UID: 00000000-00003532) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000cf63f572022d2ec69035f5722818f57202000000a07ff5725c616f0040616f0010ce58000018f772e4ce58004064f572ee1c80b4feffffff50ce58000064f572a07ff57268ce58009f35f572a07ff572cf7b697701000000d015f77294ce5800a15df5720018f5722c18f5720000000019de82760000000001000000 (UID: 00000000-00003532) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000018f57202000000110000005c616f00800000000000000000006f00e4ce58004064f572ee1c80b458ce5800feba7777000000000000000080000000a042f87278ce58002d83677700006f000000000080000000a042f872020000004418f87290ce5800ab42f87280000000d447f87201000000f015f972bcce58006144f872 (UID: 00000000-00003532) "!WannaDecryptor!.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000074a0000004a00880000000000000000000000905163000000000000000000dfe977770200000010000000c0014a00000000000200000000004a00010000000800000000006300440b4a0000000000400b4a0000f01900feba77770800000000000000080000000100000044f21900da912573000063000800000001000000 (UID: 00000000-00006580)2a:T73f,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "!WannaDecryptor!.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2b:Tad1,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileA" to copy u.wry to new location !WannaDecryptor!.exe (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !Please Read Me!.txt to new location C:\!Please Read Me!.txt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !WannaDecryptor!.exe.lnk to new location C:\!WannaDecryptor!.exe.lnk (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !Please Read Me!.txt to new location C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\!Please Read Me!.txt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !WannaDecryptor!.exe.lnk to new location C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\!WannaDecryptor!.exe.lnk (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !Please Read Me!.txt to new location %USERPROFILE%\Microsoft\Diagnosis\!Please Read Me!.txt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !WannaDecryptor!.exe.lnk to new location %USERPROFILE%\Microsoft\Diagnosis\!WannaDecryptor!.exe.lnk (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !Please Read Me!.txt to new location %USERPROFILE%\Microsoft\User Account Pictures\!Please Read Me!.txt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !WannaDecryptor!.exe.lnk to new location %USERPROFILE%\Microsoft\User Account Pictures\!WannaDecryptor!.exe.lnk (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !Please Read Me!.txt to new location %USERPROFILE%\.mitmproxy\!Please Read Me!.txt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !WannaDecryptor!.exe.lnk to new location %USERPROFILE%\.mitmproxy\!WannaDecryptor!.exe.lnk (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !Please Read Me!.txt to new location %LOCALAPPDATA%\!Please Read Me!.txt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CopyFileW" to copy !WannaDecryptor!.exe.lnk to new location %LOCALAPPDATA%\!WannaDecryptor!.exe.lnk (UID: 00000000-00003684)2c:T455,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CreateProcessA" with parameter "157061717423050.bat" - (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CreateProcessA" with parameter "!WannaDecryptor!.exe f" - (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CreateProcessA" with parameter "taskkill /f /im MSExchange*" - (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CreateProcessA" with parameter "taskkill /f /im Microsoft.Exchange.*" - (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CreateProcessA" with parameter "taskkill /f /im sqlserver.exe" - (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "CreateProcessA" with parameter "taskkill /f /im sqlwriter.exe" - (UID: 00000000-00003684) "cmd.exe" called "CreateProcessW" with parameter "cscript //nologo c.vbs" - (UID: 00000000-00009660)2d:Tf13,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter MSVCRT.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter MSVCP60.dll (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003684) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009660) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009660) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009660) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009660) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00003532) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003532) "!WannaDecryptor!.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006580)2e:Tb2fe,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter InterlockedExchangeAdd (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetEntriesInAclA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WNetAddConnection2A (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter WNetCancelConnection2A (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter time (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcscat (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter __CxxFrameHandler (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter swprintf (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _except_handler3 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _local_unwind2 (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcsrchr (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcsstr (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter wcschr (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _ftol (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??0exception@@QAE@ABV0@@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??1exception@@UAE@XZ (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??0exception@@QAE@ABQBD@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?_Xran@std@@YAXXZ (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z (UID: 00000000-00003684) "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003684) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009660) "cmd.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00009660) "cscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00003532) "cscript.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00003532) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006580) "!WannaDecryptor!.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006580)2f:Tcab8,Found reference to API (Indicator: "CryptDestroyKey"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CryptDecrypt"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CryptImportKey"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CryptAcquireContextA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "HeapFree"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GlobalFree"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FreeLibrary"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "HeapAlloc"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetFileTime"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "VirtualProtect"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SizeofResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetFileSize"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LockResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetErrorMode"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetProcAddress"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetFilePointer"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ReadFile"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WriteFile"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CloseHandle"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LoadResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "VirtualFree"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "IsBadReadPtr"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateFileA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FindResourceA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetLastError"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "wsprintfA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WSAStartup"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "inet_addr"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WSACleanup"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "RegCloseKey"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FreeSid"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CryptEncrypt"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "RegCreateKeyW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetObjectA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateFontA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "TextOutA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ExtTextOutA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "BitBlt"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DeleteObject"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CopyFileW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "TerminateThread"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CopyFileA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ExitProcess"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FindNextFileW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FindClose"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DeleteFileA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DeleteFileW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GlobalLock"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetFileTime"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateThread"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetComputerNameA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FindNextFileA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateProcessA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CreateFileW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "Sleep"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "MoveFileW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WNetAddConnection2A"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WNetCancelConnection2A"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "NetShareEnum"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "NetApiBufferFree"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ShellExecuteExA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetFocus"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetParent"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "RedrawWindow"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "OffsetRect"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "KillTimer"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ShowWindow"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetWindowPos"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "EnableWindow"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DrawIcon"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GrayStringA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetSysColor"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DrawTextA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetClipboardData"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SendMessageA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "GetClientRect"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "IsIconic"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "InvalidateRect"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "TabbedTextOutA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetTimer"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LoadCursorA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "LoadIconA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "FillRect"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CloseClipboard"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "SetCursor"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "OpenClipboard"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "DeleteUrlCacheEntry"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "ioctlsocket"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "gethostbyname"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "inet_ntoa"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "htons"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "closesocket"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "URLDownloadToFileA"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptGetKeyParam"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptGenKey"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "NetShareEnum"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "WNetCancelConnection2A"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "WNetAddConnection2A"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.1000D000.00000004.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000001.252910.1000D000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.1000D000.00000004.mdmp")30:T45b,Found string "%WINDIR%\system32\cmd.exe /c 157061717423050.bat" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c 157061717423050.bat" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "INDOWS\system32\cmd.exe /c 157061717423050.bat" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp") Found string "INDOWS\system32\cmd.exe /c 157061717423050.bat" (Indicator: "cmd.exe /c"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c" (Indicator: "cmd.exe /c"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp") Found string "cmd.exe /c start /b %s v" (Indicator: "cmd.exe /c"; Source: "00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.1000D000.00000004.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000001.252910.1000D000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.1000D000.00000004.mdmp")31:T468,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003684.00000000.250989.00408000.00000002.mdmp")32:T1894,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76630000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76630000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76630000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "KERNEL32" at base 75d00000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73420000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73390000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75ed0000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "KERNEL32.DLL" at base 75d00000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "USER32.DLL" at base 77080000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "ADVAPI32.DLL" at base 76c60000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "SHELL32.DLL" at base 75f40000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "WS2_32.DLL" at base 77340000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "NETAPI32.DLL" at base 73320000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "MPR.DLL" at base 75190000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "MSVCRT.DLL" at base 77630000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "MSVCP60.DLL" at base 73280000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "RPCRT4.DLL" at base 76e60000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "NTDLL.DLL" at base 77730000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "KERNELBASE" at base 76630000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b60000 "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" loaded module "SSPICLI.DLL" at base 74120000 "cmd.exe" loaded module "KERNEL32" at base 75d00000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76630000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76630000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76630000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75890000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76630000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76630000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76630000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73420000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75d00000 "cmd.exe" loaded module "NTDLL.DLL" at base 77730000 "cmd.exe" loaded module "KERNELBASE" at base 76630000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74c10000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76630000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76630000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76630000 "cscript.exe" loaded module "KERNEL32" at base 75d00000 "cscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73420000 "cscript.exe" loaded module "KERNEL32.DLL" at base 75d00000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c30000 "cscript.exe" loaded module "RPCRT4.DLL" at base 76e60000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\VBSCRIPT.DLL" at base 73100000 "cscript.exe" loaded module "AMSI.DLL" at base 730e0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75420000 "cscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 73070000 "cscript.exe" loaded module "WLDP.DLL" at base 73020000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76c60000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73390000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 73000000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 77230000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 72fe0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\SCROBJ.DLL" at base 72fa0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 72f80000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73a20000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 741e0000 "cscript.exe" loaded module "CSCAPI.DLL" at base 73520000 "!WannaDecryptor!.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76630000 "!WannaDecryptor!.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76630000 "!WannaDecryptor!.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76630000 "!WannaDecryptor!.exe" loaded module "KERNEL32" at base 75d00000 "!WannaDecryptor!.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73420000 "!WannaDecryptor!.exe" loaded module "KERNEL32.DLL" at base 75d00000 "!WannaDecryptor!.exe" loaded module "RICHED32.DLL" at base 73270000 "!WannaDecryptor!.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c30000 "!WannaDecryptor!.exe" loaded module "COMCTL32.DLL" at base 751b0000 "!WannaDecryptor!.exe" loaded module "COMCTL32" at base 751b0000 "!WannaDecryptor!.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73470000 "!WannaDecryptor!.exe" loaded module "RPCRT4.DLL" at base 76e60000 "!WannaDecryptor!.exe" loaded module "SSPICLI.DLL" at base 74120000 "!WannaDecryptor!.exe" loaded module "USER32.DLL" at base 7708000033:T4d7,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40d420,push 0x406ed4,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x4080bc],pop ecx,or dword ptr [0x40f6a0], 0xffffffff,or dword ptr [0x40f6a4], 0xffffffff,call dword ptr [0x4080c0],mov ecx, dword ptr [0x40f69c],mov dword ptr [eax], ecx,call dword ptr [0x4080e8],mov ecx, dword ptr [0x40f698],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4080c4]," "u.wry" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x41ab68,push 0x4124aa,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x414508],pop ecx,or dword ptr [0x42129c], 0xffffffff,or dword ptr [0x4212a0], 0xffffffff,call dword ptr [0x414504],mov ecx, dword ptr [0x421290],mov dword ptr [eax], ecx,call dword ptr [0x414500],mov ecx, dword ptr [0x42128c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4144fc],"34:T4f8,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "!WannaDecryptor!.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "!WannaDecryptor!.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "!WannaDecryptor!.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")35:T57a,"!WannaDecryptor!.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Jun 3 13:57:30 2024 mtime=Mon Jun 3 13:57:30 2024 atime=Wed May 11 21:40:48 2016 length=241664 window=hide"- Location: [C:\!WannaDecryptor!.exe.lnk]- [targetUID: 00000000-00003532] "157061717423050.bat" has type "DOS batch file ASCII text with CRLF CR line terminators"- Location: [C:\157061717423050.bat]- [targetUID: 00000000-00009660] "c.vbs" has type "ASCII text with CRLF line terminators"- Location: [C:\c.vbs]- [targetUID: 00000000-00009660] "u.wry" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\u.wry]- [targetUID: 00000000-00003684] "m.wry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\m.wry]- [targetUID: 00000000-00003684] "pycore_pyarena.h.WCRYT" has type "COM executable for MS-DOS"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\include\internal\pycore_pyarena.h.WCRYT]- [targetUID: 00000000-00003684] "f.wry" has type "ASCII text with CRLF line terminators"- Location: [C:\f.wry]- [targetUID: 00000000-00003684] "!Please Read Me!.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\!Please Read Me!.txt]- [targetUID: 00000000-00003684] "r.wry" has type "ASCII text with CRLF line terminators"- Location: [C:\r.wry]- [targetUID: 00000000-00003684]36:T4f8,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "")37:Tb29,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")38:T4c6,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\t.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\c.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\u.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\r.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\00000000.pky" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\!please read me!.txt" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\!wannadecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\programdata\microsoft\windows\wer\temp\wer.1f03028b-ada9-4b97-9864-c53b003a2832.tmp.csv" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\programdata\microsoft\windows\wer\temp\wer.752e1475-8cc0-49a3-a007-5f9791e67710.tmp.txt" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" reads file "c:\programdata\microsoft\windows defender\platform\4.18.23050.9-0\thirdpartynotices.txt"39:T405,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\c.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\m.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to touch file "C:\r.wry"3a:T8eb,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\~SDE65F.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\~SDE65F.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\~SDE660.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\~SDE660.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\~SDE680.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\~SDE680.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\~SDE681.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\~SDE681.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\~SDE682.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\~SDE682.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\~SDE683.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\~SDE683.tmp" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\~SDE694.tmp"3b:T563,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "C:\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "C:\Users\All Users\Microsoft\Diagnosis\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "C:\ProgramData\Microsoft\Diagnosis\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "C:\Users\All Users\Microsoft\User Account Pictures\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "C:\ProgramData\Microsoft\User Account Pictures\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "%USERPROFILE%\Microsoft\Diagnosis\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Diagnosis\!WannaDecryptor!.exe.lnk" "cscript.exe" trying to access LNK file "C:\!WannaDecryptor!.exe.lnk"3c:T6e4,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\CRYPTSP.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\crypt32.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\bcrypt.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\NETAPI32.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\SAMCLI.DLL" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\SRVCLI.DLL" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\NETUTILS.DLL" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\MPR.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\MSVCP60.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\SspiCli.dll" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\taskkill.exe" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "taskkill.exe" "cscript.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "!WannaDecryptor!.exe" trying to access non-existent file "C:\profapi.dll"3d:T747,"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\c.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\m.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\r.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\t.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\u.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\crypt32.dll.mui" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\00000000.dky" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\!WannaDecryptor!.exe.lnk" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\00000000.pky" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\00000000.res" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\f.wry" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "Z:\$RECYCLER" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "Z:\" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "Z:\$RECYCLER\" "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe" trying to access non-existent file "C:\share\$RECYCLER\0.WCRYT"3e:Tc2d,Heuristic match: "f$F.Cm" Pattern match: "http://%d/%d/%d" Heuristic match: "Microsoft.NET" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "sqjolphimrr7jqw6.onion" Heuristic match: "WMDEFA~1.PY" Heuristic match: "WmDefault.py" Heuristic match: "_MSVCC~1.PY" Heuristic match: "TTKPRO~1.TCLttkprogress.tclitfor.py" Heuristic match: "test_poplib.py" Heuristic match: "Final-Recipient: rfc822; xxx@dot.ca.gov" Heuristic match: "Final-Recipient: rfc822; xxxxxxx@dot.ca.gov" Heuristic match: "Final-Recipient: rfc822; xxxxxxxxxxxxxxx@dot.ca.gov" Heuristic match: "Final-Recipient: rfc822; xxxxxxxxxx@dot.ca.gov" Heuristic match: "From: webmaster@python.org" Heuristic match: "To: xxxxx@dot.ca.gov" Heuristic match: "-- These are tested in testAtanSign in test_cmath.py" Heuristic match: "-- These are tested in testAtanhSign in test_cmath.py" Pattern match: "https://github.com/python/pythondotorg/issues/945" Pattern match: "https://github.com/libexpat/libexpat/issues/115" Pattern match: "https://sourceforge.net/p/expat/bugs/537/" Pattern match: "https://github.com/python/typing" Heuristic match: "- bpo-27705: Update message in validate_ucrtbase.py" Pattern match: "sndhdr.what/whathdr" Pattern match: "http://www.python.org/" Pattern match: "http://www.example.com" Pattern match: "https://github.com/python/typing/issues/751" Heuristic match: "- bpo-40964: Disable remote :mod:`imaplib` tests, host cyrus.andrew.cmu.edu" Heuristic match: "in webbrowser.py" Pattern match: "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274" Pattern match: "https://www.w3.org/TR/xml/#sec-prolog-dtd" Pattern match: "https://importlib-metadata.readthedocs.io/en/latest/changelog%20(links).html#v1-5-0" Heuristic match: "- bpo-39242: Updated the Gmane domain from news.gmane.org to news.gmane.io" Pattern match: "https://fishshell.com/docs/current/commands.html#source" Heuristic match: "- bpo-38586: Now :func:`~logging.config.fileConfig` correctly sets the .name" Pattern match: "https://gitlab.com/python-devs/importlib_metadata/blob/0.21/importlib_metadata/docs/changelog.rst" Pattern match: "https://gitlab.com/python-devs/importlib_metadata/-/milestones/20" Pattern match: "https://docs.python.org/zh-cn/" Heuristic match: "- bpo-36544: Fix regression introduced in bpo-36146 refactoring setup.py" Heuristic match: "- bpo-34144: Fixed activate.bat to correctly update codepage when chcp.com" Pattern match: "https://github.com/python/typed_ast" Heuristic match: "- bpo-34558: Correct typo in Lib/ctypes/_aix.py" Heuristic match: "- bpo-33061: Add missing ``NoReturn`` to ``__all__`` in typing.py" Pattern match: "https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_min_proto_version.html" Pattern match: "https://docs.python.org/3/" Pattern match: "https://python.visualstudio.com/cpython" Heuristic match: "- bpo-29442: Replace optparse with argparse in setup.py" Pattern match: "https://github.com/pypa/setuptools/issues/100" Heuristic match: "zwI.Gf" Heuristic match: "q'.bf" Heuristic match: "*z.bM" Heuristic match: "k[.kG"3f:T728,Found URL "https://github.com/python/pythondotorg/issues/945)build------" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://github.com/libexpat/libexpat/issues/115what's" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://sourceforge.net/p/expat/bugs/537/" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://github.com/python/typing:" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://github.com/python/pythondotorg/issues/945)tools/demos------------" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "http://www.python.org/" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://www.python.org:" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "http://www.example.com" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://github.com/python/typing/issues/751>" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274-" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "https://www.w3.org/tr/xml/" - Source: "00000000-00003684.00000001.252910.02E0D000.00000004.mdmp") Found URL "http://www.w3.org/1999/xlink" - Source: "00000000-00003684.00000002.254829.02E0D000.00000004.mdmp") Found URL "https://fkie.fraunhofer.de>) YARA signature "win_wannacryptor_g0" classified file "u.wry" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "unzip 0.15 Copyright 1998 Gilles Vollant,inflate 1.1.3 Copyright 1995-1998 Mark Adler,GetLogicalDrives,GetDriveType,FindFirstFileA,FindNextFileA,CryptImportKey,.wry,525341320008000001000100,/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" (Author: Daniel Plohmann fkie.fraunhofer.de>)50:T4b2,"WannaCry.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "WannaCry.exe" trying to access non-existent file "C:\C.WRY" "WannaCry.exe" trying to access non-existent file "C:\M.WRY" "WannaCry.exe" trying to access non-existent file "C:\R.WRY" "WannaCry.exe" trying to access non-existent file "C:\T.WRY" "WannaCry.exe" trying to access non-existent file "C:\U.WRY" "WannaCry.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WannaCry.exe" trying to access non-existent file "C:\CRYPTSP.dll" "WannaCry.exe" trying to access non-existent file "C:\BCRYPT.DLL" "WannaCry.exe" trying to access non-existent file "C:\bcrypt.dll" "WannaCry.exe" trying to access non-existent file "C:\CRYPT32.DLL" "WannaCry.exe" trying to access non-existent file "C:\crypt32.dll" "WannaCry.exe" trying to access non-existent file "C:\NETAPI32.DLL" "WannaCry.exe" trying to access non-existent file "C:\NETAPI32.dll" "WannaCry.exe" trying to access non-existent file "C:\SRVCLI.DLL" "WannaCry.exe" trying to access non-existent file "C:\NETUTILS.DLL" "WannaCry.exe" trying to access non-existent file "C:\MPR.DLL" "WannaCry.exe" trying to access non-existent file "C:\MPR.dll"51:T7ba,Found dropped filename "pspubws@www.ichwillkuehe[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.upsellit[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.rightmove.co[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@atdmt[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@qqtn[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@vsemtube[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.sohu[2].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.livedoor[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@adsrvr[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@weather[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.telegraph.co[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@filesonic[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@vlion[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@gssprt[2].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@o2online[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.pchome[2].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.addthis[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.msn[1].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@letitbit[2].txt.WCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@criteo[2].txt.WCRYT" containing the Windows username "PSPUBWS"52:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==54:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAALsAAAAAAAAAAAAAAAAAAAuw//AAAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAALu7u//wAAAAAAAAAAAAAAAAu7//8AAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAALsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzMzMzMzMwAAAAAAAAAAAwMzMzMzMzAoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAMzMzMzMzMwKqgAAAAAAAAAAAAAAAAAAqqoACwuwAAAJmZmZmZmZkKqqAAsLAAAACZmZmZmZmZCqqgALuwAAAAmZmZmZmZmQqqoLu7vwAAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCgAAAP//8AAAmZmZmZmZmQqqoAD///AAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqoAAAAAAAAAmZmZmZmZmQqgAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4P///8B///8AP///AD///8A///+Qf///OP////3////9/////f////3////8AAP/+AAD//AAA//gAAP/wAAD/4AAA0+AAANfgAADD4AAAAeAAAIDgAAAA4AAAgOAAAMHgAAHz4AAD/+AAB//gAA//4AAf/////////////////w==55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////8P///////////////////wAA//////////////////AHcA////////////////8Ad3cA///////////////wB3dwD///////////////AHd3AA//////////////8Ad3cAD//////////////wB3dwAP//////////////AHd3AA///////////z//8Ad3cAD///////////OD/wB3dwAP//////////87g/AHd3AA///////////zOLMAd3cAD///////////M4u7N3dwAP//////8zMzMziLuzd3AA////////OIiIiIu7s3cAD////////zP4iIiLu7gzM//////////zuIiIi7u7iIMz////////8ziIiIi7u7u4hz////////8ziIiIi7u7uzP/////////87/4iIiIu7M///////////N//4iIiIsz///////////zj///iIizP///////////M/////iIs////////////zP/////iDP///////////84/4g7j/gz////////////OLMzMzj/M////////////zMz//8zvzP//////////////////zMz///////////////////zP///////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==56:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==57:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==58:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==59:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////8P///////////////////wAA//////////////////AHcA////////////////8Ad3cA///////////////wB3dwD///////////////AHd3AA//////////////8Ad3cAD//////////////wB3dwAP//////////////AHd3AA///////////z//8Ad3cAD///////////OD/wB3dwAP//////////87g/AHd3AA///////////zOLMAd3cAD///////////M4u7N3dwAP//////8zMzMziLuzd3AA////////OIiIiIu7s3cAD////////zP4iIiLu7gzM//////////zuIiIi7u7iIMz////////8ziIiIi7u7u4hz////////8ziIiIi7u7uzP/////////87/4iIiIu7M///////////N//4iIiIsz///////////zj///iIizP///////////M/////iIs////////////zP/////iDP///////////84/4g7j/gz////////////OLMzMzj/M////////////zMz//8zvzP//////////////////zMz///////////////////zP///////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==5c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////8P///////////////////wAA//////////////////AHcA////////////////8Ad3cA///////////////wB3dwD///////////////AHd3AA//////////////8Ad3cAD//////////////wB3dwAP//////////////AHd3AA///////////z//8Ad3cAD///////////OD/wB3dwAP//////////87g/AHd3AA///////////zOLMAd3cAD///////////M4u7N3dwAP//////8zMzMziLuzd3AA////////OIiIiIu7s3cAD////////zP4iIiLu7gzM//////////zuIiIi7u7iIMz////////8ziIiIi7u7u4hz////////8ziIiIi7u7uzP/////////87/4iIiIu7M///////////N//4iIiIsz///////////zj///iIizP///////////M/////iIs////////////zP/////iDP///////////84/4g7j/gz////////////OLMzMzj/M////////////zMz//8zvzP//////////////////zMz///////////////////zP///////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==5e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////8P///////////////////wAA//////////////////AHcA////////////////8Ad3cA///////////////wB3dwD///////////////AHd3AA//////////////8Ad3cAD//////////////wB3dwAP//////////////AHd3AA///////////z//8Ad3cAD///////////OD/wB3dwAP//////////87g/AHd3AA///////////zOLMAd3cAD///////////M4u7N3dwAP//////8zMzMziLuzd3AA////////OIiIiIu7s3cAD////////zP4iIiLu7gzM//////////zuIiIi7u7iIMz////////8ziIiIi7u7u4hz////////8ziIiIi7u7uzP/////////87/4iIiIu7M///////////N//4iIiIsz///////////zj///iIizP///////////M/////iIs////////////zP/////iDP///////////84/4g7j/gz////////////OLMzMzj/M////////////zMz//8zvzP//////////////////zMz///////////////////zP///////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790822048810,"unified_at":"2026-10-01T02:34:08.810Z","metadata":{"hashes":{"sha256":"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844","sha1":"120ed9279d85cbfa56e5b7779ffa7162074f7a29","md5":"5c7fb0927db37372da25f270708103a2","sha512":"a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206","ssdeep":"3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ","ssdeep_chunks":["3072:Y059fem","3072:059femW","3072:59femWR","3072:9femWRw","3072:femWRwT","3072:emWRwTs","3072:mWRwTs/","3072:WRwTs/d","3072:RwTs/db","3072:wTs/dbe","3072:Ts/dbel","3072:s/dbelj","3072:/dbelj0","3072:dbelj0X","3072:belj0X8","3072:elj0X8/","3072:lj0X8/j","3072:j0X8/j8","3072:0X8/j84","3072:X8/j84p","3072:8/j84pc","3072:/j84pcR","3072:j84pcRX","3072:84pcRXP","3072:4pcRXPl","3072:pcRXPlU","3072:cRXPlU3","3072:RXPlU3U","3072:XPlU3Up","3072:PlU3Upt","3072:lU3Upt3","3072:U3Upt3o","3072:3Upt3or","3072:Upt3or4","3072:pt3or4H","3072:t3or4H8","3072:3or4H84","3072:or4H84l","3072:r4H84lK","3072:4H84lK8","3072:H84lK8P","3072:84lK8Pt","3072:4lK8Ptp","3072:lK8PtpL","3072:K8PtpLz","3072:8PtpLzL","3072:PtpLzLs","3072:tpLzLsR","3072:pLzLsR/","3072:LzLsR/E","3072:zLsR/Ef","3072:LsR/Efc","3072:sR/EfcZ","6144:Y059fem","6144:059femW","6144:59femWR","6144:9femWRw","6144:femWRwT","6144:emWRwTs","6144:mWRwTs/","6144:WRwTs/d","6144:RwTs/db","6144:wTs/dbe","6144:Ts/dbel","6144:s/dbelj","6144:/dbelj0","6144:dbelj0X","6144:belj0X8","6144:elj0X8/","6144:lj0X8/j","6144:j0X8/j8","6144:0X8/j84","6144:X8/j84p","6144:8/j84pc","6144:/j84pcR","6144:j84pcRX","6144:84pcRXP","6144:4pcRXPl","6144:pcRXPlU","6144:cRXPlU3","6144:RXPlU3U","6144:XPlU3Up","6144:PlU3Upt","6144:lU3Upt3","6144:U3Upt3o","6144:3Upt3or","6144:Upt3or4","6144:pt3or4H","6144:t3or4H8","6144:3or4H84","6144:or4H84l","6144:r4H84lK","6144:4H84lK8","6144:H84lK8P","6144:84lK8Pt","6144:4lK8Ptp","6144:lK8PtpL","6144:K8PtpLz","6144:8PtpLzL","6144:PtpLzLs","6144:tpLzLsR","6144:pLzLsR/","6144:LzLsR/E","6144:zLsR/Ef","6144:LsR/Efc","6144:sR/EfcZ","3072:+5RwTs/","3072:5RwTs/d","3072:RwTs/dS","3072:wTs/dSX","3072:Ts/dSXj","3072:s/dSXj8","3072:/dSXj84","3072:dSXj84m","3072:SXj84mR","3072:Xj84mRX","3072:j84mRXP","3072:84mRXPe","3072:4mRXPem","3072:mRXPemx","3072:RXPemxd","3072:XPemxdB","3072:PemxdBl","3072:emxdBlP","3072:mxdBlPv","3072:xdBlPvL","3072:dBlPvLz","3072:BlPvLzL","3072:lPvLzLe","3072:PvLzLeZ"],"imphash":"e858a14f217810d78466806d95d7fceb"},"file_info":{"file_name":"download.zip","file_type":["peexe","executable"],"file_type_id":"exe","file_size":229376,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286902000,"last_seen":1785139134000,"last_multi_scan":1785139134000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","ransomware","wanaransomware","banker","emotet","wanacrypt0r","wannacry","wcry","bravonc","pepex","killmbr"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":200,"suspicious_count":39,"malicious_count":17,"total":256},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.WannaCryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Wanna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.WannaCryptor.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Wannacryptor-6993233-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_Cryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.WannaCryptor.D (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.WannaCryptor.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.WannaCrypt.sd!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Wannacry.g","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050ac621 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.toRr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Windows_Malware_GenericRansomware_PE_2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Wanna-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.WannaCry.229376","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Ransom-WannaCry!5C7FB0927DB3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.XMRO-3175","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.PWG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.WannaCrypt.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Wanna.Win32.58","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.WannaCryptor","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"},{"type":"informative","value":"Executes batch file"},{"type":"informative","value":"Drops or executes a batch file"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"},{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Web Shell","attack_id":"T1505.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/003","identifiers":[{"type":"suspicious","value":"YARA signature match - Web shell"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Credential Access","technique":"Private Keys","attack_id":"T1552.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/004","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Tries to collect sensitive information via text files"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Calls an API typically used to download the file from the URL"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","identifiers":[{"type":"suspicious","value":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"suspicious","value":"Contains key cryptographic functions of the CryptoAPI"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"},{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"}]},{"tactic":"Execution","technique":"Exploitation for Client Execution","attack_id":"T1203","attack_id_wiki":"https://attack.mitre.org/techniques/T1203","sources":[{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"tactic":"Impact","technique":"Defacement","attack_id":"T1491","attack_id_wiki":"https://attack.mitre.org/techniques/T1491","identifiers":[{"type":"suspicious","value":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"FindResourceA\" with parameter \"105\" - (UID: 00000000-00003684)\n \"!WannaDecryptor!.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"FindResourceA\" with parameter \"128\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"FindResourceA\" with parameter \"102\" - (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4260024'}\" (UID: 00000000-00003684)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"around a WaitForMultipleObjects limitation.\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003684.00000001.252910.006D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$26","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"b64decode\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"base64.b64decode\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"CryptoAPI Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found string \"- bpo-38271: The private keys for test_ssl were encrypted with 3DES in\" (Indicator: \"private key\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.644352533701016","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$27","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"!WannaDecryptor!.exe\" called \"GetWindowTextA\" with parameter \"About bitcoin\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"GetWindowTextA\" with parameter \"How to buy bitcoins?\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"GetWindowTextA\" with parameter \"Contact Us\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"GetWindowTextA\" with parameter \"QR Code\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"GetWindowTextA\" with parameter \"1/1/2017 00:00:00\" - (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"GetWindowTextA\" (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003684)\n \"cscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"OpenMutexA\" with parameter \"Global\\WINDOWS_TASKCST_MUTEX\" - (UID: 00000000-00003684)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"!WannaDecryptor!.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003532)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set o = WScript.CreateObject(\"WScript.Shell\")Set ol = o.CreateShortcut(\"C:\\!WannaDecryptor!.exe.lnk\")ol.TargetPath = \"C:\\!WannaDecryptor!.exe\"ol.Save\" (Indicator: \"set \"; File: \"c.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"cmd /c ver\") in Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\n Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"/c ver\") in Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"- bpo-35890: Fix API calling consistency of GetVersionEx and wcstok.\" (Indicator: \"GetVersion\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00003532-00000C15-2922150973","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00003532-00000C15-2922150973","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"!WannaDecryptor!.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CSCRIPT.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$2b","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"CreateDirectoryW\" with parameter Z:\\$RECYCLER (UID: 00000000-00003684)\n \"!WannaDecryptor!.exe\" called \"CreateDirectoryA\" with parameter TaskHost (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"- bpo-31446: Copy command line that was passed to CreateProcessW since this\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"- bpo-23253: Delay-load ShellExecute[AW] in os.startfile for reduced startup\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$30","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"- bpo-32890: Fix usage of GetLastError() instead of errno in os.execve() and\" (Indicator: \"GetLastError\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"%USERPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*\" (Indicator: \"%userprofile%\\microsoft\\windows\\start menu\\programs\\startup\\*\") in Source: 00000000-00003684-00000C28-24240770376","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\\" in Source: 00000000-00003684.00000000.250989.006D0000.00000004.mdmp\n 00000000-00003684.00000000.250989.1000D000.00000004.mdmp\n 00000000-00003684.00000001.252910.006D0000.00000004.mdmp\n 00000000-00003684.00000001.252910.1000D000.00000004.mdmp\n 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\n 00000000-00003684.00000002.254829.1000D000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00003684.00000000.250989.006D0000.00000004.mdmp\n 00000000-00003684.00000000.250989.1000D000.00000004.mdmp\n 00000000-00003684.00000001.252910.006D0000.00000004.mdmp\n 00000000-00003684.00000001.252910.1000D000.00000004.mdmp\n 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\n 00000000-00003684.00000002.254829.1000D000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 024\" in Source: 00000000-00003684.00000000.250989.006D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:9660:168:WilStaging_02\"\n \"Local\\SM0:3532:168:WilStaging_02\"\n \"Local\\SM0:3532:64:WilError_03\"\n \"SM0:3532:64:WilError_03\"\n \"Local\\SM0:6580:168:WilStaging_02\"\n \"SM0:6580:64:WilError_03\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 157061717423050.bat\" (UID: 00000000-00009660)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\".ost\" (Indicator: \".ost\") in Source: 00000000-00003684.00000000.250989.006D0000.00000004.mdmp\n 00000000-00003684.00000000.250989.1000D000.00000004.mdmp\n 00000000-00003684.00000001.252910.006D0000.00000004.mdmp\n 00000000-00003684.00000001.252910.1000D000.00000004.mdmp\n 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\n 00000000-00003684.00000002.254829.1000D000.00000004.mdmp\n \".pst\" (Indicator: \".pst\") in Source: 00000000-00003684.00000000.250989.006D0000.00000004.mdmp\n 00000000-00003684.00000000.250989.1000D000.00000004.mdmp\n 00000000-00003684.00000001.252910.006D0000.00000004.mdmp\n 00000000-00003684.00000001.252910.1000D000.00000004.mdmp\n 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\n 00000000-00003684.00000002.254829.1000D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/python/pythondotorg/issues/945)\" (Indicator: \"github.com\")\n \"https://github.com/libexpat/libexpat/issues/115\" (Indicator: \"github.com\")\n \"- A new version of typing.py from https://github.com/python/typing:\" (Indicator: \"github.com\")\n \"`\" (Indicator: \"github.com\")\n \"[typed_ast](https://github.com/python/typed_ast).\" (Indicator: \"github.com\")\n \"See `setuptools 100 `_ for\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"cscript //nologo c.vbs\" (UID: 00000000-00003532)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"!WannaDecryptor!.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 73270000\n \"!WannaDecryptor!.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 731F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 730E0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72C10000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75ED0000\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73350000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75ED0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75ED0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E60000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E60000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E60000\n \"!WannaDecryptor!.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E60000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"cscript.exe\" called \"WScript.Shell.1.Unnamed\" ... \n \"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\!WannaDecryptor!.exe.lnk\" ...\n \"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" was detected as \"Zip\" and name: \"Archive\"\n \"u.wry\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"u.wry\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"u.wry\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"u.wry\" was detected as \"Zip\" and name: \"Archive\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"cscript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")\n \"cscript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"cscript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")\n \"cscript.exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\\TREATAS\")\n \"cscript.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\TREATAS\")\n \"cscript.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"cscript.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" has an executable section named \".text\"\n \"u.wry\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" has an writable section named \".data\"\n \"u.wry\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" [Source: 00000000-00003684-00000BC1-2919986628]\n Observed system executable string:\"%WINDIR%\\system32\\cscript.exe\" [Source: 00000000-00009660-00000C41-1349379676]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00009660-00000BC0-2920097270]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cscript.exe\" [Source: 00000000-00009660-00000BC0-2920685638]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c 157061717423050.bat\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00009660) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00009660) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cscript.exe\" (UID: 00000000-00003532) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"!WannaDecryptor!.exe\" (UID: 00000000-00006580) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00003532-00000C25-2921452230]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00003532-00000C25-2921516796]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" searching for window \"Wanna Decryptor 1.0\"\n \"!WannaDecryptor!.exe\" searching for window \"Wanna Decryptor 1.0\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"!WannaDecryptor!.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 5648","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 157061717423050.bat\" (UID: 00000000-00009660)\n Spawned process \"cscript.exe\" with commandline \"cscript //nologo c.vbs\" (UID: 00000000-00003532)\n Spawned process \"!WannaDecryptor!.exe\" with commandline \"f\" (UID: 00000000-00006580)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im MSExchange*\" (UID: 00000000-00002528)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im Microsoft.Exchange.*\" (UID: 00000000-00009672)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im sqlserver.exe\" (UID: 00000000-00004128)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im sqlwriter.exe\" (UID: 00000000-00005196)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 157061717423050.bat\" (UID: 00000000-00009660)\n Spawned process \"cscript.exe\" with commandline \"cscript //nologo c.vbs\" (UID: 00000000-00003532)\n Spawned process \"!WannaDecryptor!.exe\" with commandline \"f\" (UID: 00000000-00006580)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im MSExchange*\" (UID: 00000000-00002528)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im Microsoft.Exchange.*\" (UID: 00000000-00009672)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im sqlserver.exe\" (UID: 00000000-00004128)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /im sqlwriter.exe\" (UID: 00000000-00005196)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"u.wry\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes to a file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1f03028b-ada9-4b97-9864-c53b003a2832.tmp.csv.WCRYT\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes to a file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.752e1475-8cc0-49a3-a007-5f9791e67710.tmp.txt.WCRYT\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"cscript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"!WannaDecryptor!.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$35","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" queries basic process information of the \"C:\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (UID: 3684)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes file \"c:\\c.wry\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes file \"c:\\m.wry\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes file \"c:\\r.wry\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes file \"c:\\t.wry\"\n \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" writes file \"c:\\u.wry\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"sqjolphimrr7jqw6.onion\" (Indicator: \".onion\") in Source: 00000000-00003684.00000000.250989.1000D000.00000004.mdmp\n 00000000-00003684.00000001.252910.1000D000.00000004.mdmp\n 00000000-00003684.00000002.254829.1000D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"fix _winapi.PeekNamedPipe() and _winapi.ReadFile() for read larger than\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"smtpd.SMTPChannel and smtpd.SMTPServer constructors is changed to False.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found reference to \"the SMTPServerDisconnected error until the next command is issued.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"- bpo-15014: smtp.auth() and smtp.login() now support rfc 4954's optional\" [Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp]\n Observed email domain:\":meth:`smtplib.smtp.connect` is called.\" [Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp]\n Observed email domain:\"- bpo-36348: the :meth:`imap.imap4.logout` method no longer ignores silently\" [Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp]\n Observed email domain:\"- bpo-34246: :meth:`smtplib.smtp.send_message` no longer modifies the\" [Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"70.242.162.63\" found in string \"Received: from kgsav.org (ppp-70-242-162-63.dsl.spfdmo.swbell.net [70.242.162.63])\"\n Potential IP \"127.0.0.1\" found in string \"example, ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the\"\n Potential IP \"127.0.0.1\" found in string \"``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an\"\n Potential IP \"127.0.0.1\" found in string \"and all data after whitespace, e.g. '127.0.0.1 whatever'.\"\n Potential IP \"127.0.0.1\" found in string \"been added for your ``127.0.0.1`` needs, similar to the existing HOSTv6\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /v2/content/4b16e37b891a6d90d82067edca05c1caa1228290?partitionId=4&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F1199d878-7e14-432d-ba69-ace01dbb7c39&profile=1048832&CacheId=7 HTTP/1.1Connection: Keep-Alive\n Accept: */*\n Accept-Encoding: gzip\n deflate\n User-Agent: Microsoft-Delivery-Optimization/10.1\n MS-CV: E3LoiAbGHUmXpG94.2.3.1.0.0.10.1.1.1.2.1.1\n Content-Length: 0\n Host: disc601.prod.do.dsp.mp.microsoft.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: u.wry]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: u.wry]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$40","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://disc601.prod.do.dsp.mp.microsoft.com/v2/content/4b16e37b891a6d90d82067edca05c1caa1228290?partitionId=4&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F1199d878-7e14-432d-ba69-ace01dbb7c39&profile=1048832&CacheId=7","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003684\"\n YARA signature for AES encryption matched on process \"00000000-00006580\"\n YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"u.wry\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"!WannaDecryptor!.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"cscript.exe\" called \"GetComputerNameW\" (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" called \"GetUserNameW\" (UID: 00000000-00003684)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the user does not have read access. Patch by Pablo Galindo and Matt\" (Indicator: \"where \"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found string \"where an arena could be created and destroyed anew on each iteration.\" (Indicator: \"where \"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found string \"where the first and third arguments are relatively prime.\" (Indicator: \"where \"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found string \"where it could read bytes beyond the end of bounds of an array when\" (Indicator: \"where \"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir parameters and returns bytes in such situations (matching the os\" (Indicator: \"dir \"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"- bpo-30205: Fix getsockname() for unbound AF_UNIX sockets on Linux.\" (Indicator: \"getsockname\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found reference to API \"- bpo-37405: Fixed regression bug for socket.getsockname() for non-CAN_ISOTP\" (Indicator: \"getsockname\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")\n Found reference to API \"- bpo-34490: On AIX with AF_UNIX family sockets getsockname() does not\" (Indicator: \"getsockname\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$46","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%USERPROFILE%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00003684-00000C28-21133794790\")\n \"%USERPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00003684-00000C28-21140417358\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"::msgcat::mcset nl \"\" \"\"\" (Indicator: \"\"; Source: \"00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$47","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\n Observed string: \"shutdown to call objects destructors. So \"unclosed file\" resource warnings\" (Indicator: \"shutdown \") in Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp\n Observed string: \"shutdown even when there was a custom handler set previously. Patch by\" (Indicator: \"shutdown \") in Source: 00000000-00003684.00000001.252910.02E0D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003684.00000000.250989.00408000.00000002.mdmp, 00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \",|�\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: u.wry]\n Observed import api \"CheckTokenMembership\" which can \"Determines whether a specified security identifier (SID) is enabled in an access token\" [Source: u.wry]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: u.wry]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: u.wry]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00003684.00000000.250989.006D0000.00000004.mdmp, 00000000-00003684.00000000.250989.10008000.00000002.mdmp, 00000000-00003684.00000001.252910.006D0000.00000004.mdmp, 00000000-00003684.00000002.254829.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"pycore_pyarena.h.WCRYT\" - Location: [%LOCALAPPDATA%\\Programs\\Python\\Python311\\include\\internal\\pycore_pyarena.h.WCRYT]- [targetUID: 00000000-00003684]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"u.wry\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"!WannaDecryptor!.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.99320009606","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (Thread ID: 9316) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"log20634 log2 3.1258285390731669e-49 -> -161.13023800505653\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"!WannaDecryptor!.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"u.wry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\u.wry]- [targetUID: 00000000-00003684]\n \"pycore_pyarena.h.WCRYT\" has type \"COM executable for MS-DOS\"- Location: [%LOCALAPPDATA%\\Programs\\Python\\Python311\\include\\internal\\pycore_pyarena.h.WCRYT]- [targetUID: 00000000-00003684]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT UPDATE TASK SCHEDULER\"; Value: \"\"C:\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" /r\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"5c634f1b7ca3e11ed856a3b5"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"},{"report_type":"sandbox","report_id":"591775d8aac2ed361459ff12"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\u.wry\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"},{"report_type":"sandbox","report_id":"63d107f17941c834a17d6545"}]},{"level":"suspicious","category":"Network Related","name":"Calls an API typically used to download the file from the URL","description":"\"!WannaDecryptor!.exe\" called \"URLDownloadToFileW\" (UID: 00000000-00006580)\n \"!WannaDecryptor!.exe\" called \"URLDownloadToFileA\" (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-119","sources":[{"report_type":"sandbox","report_id":"665d692f45634fe22c0a1add"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","description":"Found more than 2 POST requests like this POST /RST2.srf HTTP/1.0Connection: Keep-Alive\n Content-Type: application/soap+xml\n Accept: */*\n User-Agent: MSAWindows/45 (OS 10.0.22621.0.0 ni_release; IDK 10.0.22621.1 ni_release; Cfg 16.000.29325.00; Test 0)\n Content-Length: 4694\n Host: login.live.com\n with payload ==>