26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c2588125970d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c2588125970d…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"],"about":{"@type":"SoftwareApplication","name":"onePackage.exe","applicationCategory":["peexe","executable"],"identifier":"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4fe,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "VirtualFree"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FreeMemory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "VirtualAllocEx"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "WriteVirtualMemory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NtWriteVirtualMemory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")28:T676,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SleepEx"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetTickCount64"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "WaitForMultipleObjects"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")29:T458,Found string - BUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type bdoUxXvcomplexfloat3219531259765625invaliduintptrSwapperChanDir using type= Value>ConvertFreeSidSleepExtls3desnumber charsetTrailersocks5hexpiresrefererrefresh:method:scheme:statushttp://CONNECTwindowswsarecvwsasendlookup writetoSHA-224SHA-256SHA-384SHA-512Ed25519MD5-RSAserial:%s %s; PATHEXTnil key2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9println0.0.0%s\\.\UNCavx512fos/execruntimeInstAltInstNopalt -> nop -> any -> fixed32fixed64messagepackageserviceoptionseditiontargetsmap keyExpiresSubjectanswersILLEGALCOMMENT{{end}} actioncommandoperandproto: amxtileamxint8amxbf16osxsaveUsage:PackageDefaultMessageImportsMethodsno anodeCancelIoReadFileAcceptExWSAIoctlshutdownThursdaySaturdayFebruaryNovemberDecember%!Month(ZONEINFONO_COLORhiYellowlightRedhi_greendarkGrayhundredsmillionsdurationhtmlDateinitialsswapcasewrapWithcontainstoStringcoalescefromJsondeepCopymustPushmustRestmustLastmustUniqhtpasswdurlParsehostnamefragmentuserinfokernel32FullPathrecvfr; Source: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")2a:T62a,Found string "*gzip.Header" (Indicator: "gzip.header"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.init" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.(*Reader).Reset" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.(*Reader).readString" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.(*Reader).readHeader" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.noEOF" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.(*Reader).Read" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.(*Reader).Close" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip.NewReader" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "compress/gzip/gunzip.go" (Indicator: "compress/gzip"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")2b:T6d2c,Found api reference "_packagedebug_redactdouble_valuestring_valueverificationis_extensionempty objectMime-VersionX-ImforwardsX-Powered-ByRCodeSuccessRCodeRefusedLocation(%d){{continue}}block clauseFieldOptionsOneofOptionsprotobuf_keyprotobuf_valavx5124fmapsavx512bitalgcaller errorFieldNumbersunimplementedlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameparsing time out of range in duration is too largelight_magentastrikethrough/proc/versionCOLOR_DEBUG: getHostByNamedurationRoundmustToRawJsongenPrivateKeygenSignedCertsemverComparemustRegexFindUnknown type FindFirstFileWSACloseEventgethostbyaddrgetservbyportWSAResetEventWSAIsBlockingSysFreeStringSafeArrayLockSafeArrayCopyVarI2FromDateVarI2FromDispVarI2FromBoolVarI4FromDateVarI4FromDispVarI4FromBoolVarR4FromDateVarR4FromDispVarR4FromBoolVarR8FromDateVarR8FromDispVarR8FromBoolVarDateFromI2VarDateFromI4VarDateFromR4VarDateFromR8VarDateFromCyVarCyFromD" (Indicator: "CertOpenStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "mpPath2Wgocacheverifyinstallgoroothtml/templateinvalid UTF-8reserved_namedefault_valuephp_namespacegzip, deflatename too longNtQueryObjectunexpected %sdefine clauseempty commandMethodOptionsXXX_sizecacheunknownFields for message Usage of %s: (default %q) (default %v)IsPlaceholderReservedNamesNtResumeThreadVirtualAllocExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchantime.Location(: extra text: \033\[[\d;?]+mApple_TerminalSetConsoleModehtmlDateInZonemustDateModifymergeOverwritederivePasswordmustRegexMatchmustRegexSplitregexQuoteMetaCvcvnoCvcvCvcvCvcvCvcvnoCvcvCvcvCvcvCvcvnoCvccnoCvcvCvcvCvccCvcvnoCvcvCvccCvcvCvcvnoCvcvnoCvccCvcvCvcvCvccnoCvcvCvcvCvccCvcvnoCvcvnoCvcvCvccCvcvCvcvnoCvccCvcvCvcvCvccnoCv" (Indicator: "CertCloseStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "mpPath2Wgocacheverifyinstallgoroothtml/templateinvalid UTF-8reserved_namedefault_valuephp_namespacegzip, deflatename too longNtQueryObjectunexpected %sdefine clauseempty commandMethodOptionsXXX_sizecacheunknownFields for message Usage of %s: (default %q) (default %v)IsPlaceholderReservedNamesNtResumeThreadVirtualAllocExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchantime.Location(: extra text: \033\[[\d;?]+mApple_TerminalSetConsoleModehtmlDateInZonemustDateModifymergeOverwritederivePasswordmustRegexMatchmustRegexSplitregexQuoteMetaCvcvnoCvcvCvcvCvcvCvcvnoCvcvCvcvCvcvCvcvnoCvccnoCvcvCvcvCvccCvcvnoCvcvCvccCvcvCvcvnoCvcvnoCvccCvcvCvcvCvccnoCvcvCvcvCvccCvcvnoCvcvnoCvcvCvccCvcvCvcvnoCvccCvcvCvcvCvccnoCv" (Indicator: "CryptGenRandom"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:expected integerexpected newline23841857910156250123456789ABCDEF: value of type regexp: Compile(DuplicateTokenExSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExafter object keycontent-encodingcontent-languagecontent-locationwww-authenticate%s %s HTTP/1.1User-Agent: %sContent-Length: hostLookupOrder=/etc/resolv.confnon-IPv4 addressnon-IPv6 addressunknown network no colon on lineIV for ECDSA CTRexec: no commandcontext canceledlength too largeinvalid rune %#Udivision by zeroGetCurrentThreadRtlVirtualUnwindKEYVALS UNPAIREDGODEBUG: value" (Indicator: "CryptQueryObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "runtime.newosprocruntime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff 0123456789ABCDEFX0123456789abcdefxillegal hex digitcan't scan type: 1192092895507812559604644775390625invalid bit size unknown type kind has invalid namereflect: call of reflect.Value.Capreflect.Value.Lenreflect: New(nil)RegLoadMUIStringWinvalid file sizeAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenin string literalTransfer-EncodingHEADER_TABLE_SIZEIf-Modified-Sinceif-modified-sincetransfer-encodinginvalid BMPStringinvalid IA5StringnextId too large:os/exec.Command(exec: killing Cmdexec: not startedinteger too large060102150405Z0700%%!%c(big.Int=%s)%s is equal to %sCreateFileMappingmultipartmaxpartsmissing closing )missing closing ]public_dependencyobjc_class_prefixtrailing_commentsidempotency_level%s: %v is not setmes" (Indicator: "CertFindExtension"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "runtime.newosprocruntime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff 0123456789ABCDEFX0123456789abcdefxillegal hex digitcan't scan type: 1192092895507812559604644775390625invalid bit size unknown type kind has invalid namereflect: call of reflect.Value.Capreflect.Value.Lenreflect: New(nil)RegLoadMUIStringWinvalid file sizeAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenin string literalTransfer-EncodingHEADER_TABLE_SIZEIf-Modified-Sinceif-modified-sincetransfer-encodinginvalid BMPStringinvalid IA5StringnextId too large:os/exec.Command(exec: killing Cmdexec: not startedinteger too large060102150405Z0700%%!%c(big.Int=%s)%s is equal to %sCreateFileMappingmultipartmaxpartsmissing closing )missing closing ]public_dependencyobjc_class_prefixtrailing_commentsidempotency_level%s: %v is not setmes" (Indicator: "CryptDecodeObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "tle endianCaucasian_Albanianadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem page size (elem align too big but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupunexpected newlinevalue out of range298023223876953125reflect.Value.Callreflect.Value.Elemreflect.Value.Typereflect: Zero(nil)CM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWrite" (Indicator: "CertGetNameStringW"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "tle endianCaucasian_Albanianadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem page size (elem align too big but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupunexpected newlinevalue out of range298023223876953125reflect.Value.Callreflect.Value.Elemreflect.Value.Typereflect: Zero(nil)CM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWrite" (Indicator: "CryptUnprotectData"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "tle endianCaucasian_Albanianadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem page size (elem align too big but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupunexpected newlinevalue out of range298023223876953125reflect.Value.Callreflect.Value.Elemreflect.Value.Typereflect: Zero(nil)CM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWrite" (Indicator: "PFXImportCertStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "rocessMemoryEnumProcessModulesGetModuleBaseNameWexceeded max depthinvalid character in numeric literalproxy-authenticateGo-http-client/1.1bad Content-Lengthserver misbehaving/Drivers/etc/hostsinvalid IP address/etc/nsswitch.confinvalid criteria: x509negativeserialcontext.Backgroundbufio: buffer fullnon-minimal lengthtruncated sequencesequence truncatedlen of nil pointer%s is less than %suse of closed file[^\x00-\x{10FFFF}]positive_int_valuenegative_int_valueduplicate field %vunable to parse IPRCodeServerFailureGetConsoleOutputCPunsupported type: NtReadVirtualMemoryillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectbinary.LittleEndianreflect.Value.Floatbad value for fieldEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zon" (Indicator: "CryptReleaseContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "type: %vinvalid UUID format^\s*(%s)\s*(%s)\s*$skip this directorymultipartmaxheadersjava_multiple_filescc_generic_servicespy_generic_servicesunexpected token %sgoogle.protobuf.Anyinvalid %v value %v20060102150405Z0700zero length segmentRCodeNotImplementedmodulus must be oddRUNEWIDTH_EASTASIANunclosed left parenunknown branch typetemplate: %s:%d: %sunexpected %s in %sinvalid nil pointerExtensionRangeArrayfield %v is invaliddescriptor mismatchNtUnmapViewOfSectionNtWriteVirtualMemoryinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrstime: invalid numberJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeTERM_PROGRAM_VERSIONgenSignedCertWithKeyanoxxxxxxxxxxxxxxxxxaxxxxxxxxxxxxxxxxxnoinvalid username: %sno PEM data in inputerror parsing ip:" (Indicator: "CertOpenSystemStoreW"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "type: %vinvalid UUID format^\s*(%s)\s*(%s)\s*$skip this directorymultipartmaxheadersjava_multiple_filescc_generic_servicespy_generic_servicesunexpected token %sgoogle.protobuf.Anyinvalid %v value %v20060102150405Z0700zero length segmentRCodeNotImplementedmodulus must be oddRUNEWIDTH_EASTASIANunclosed left parenunknown branch typetemplate: %s:%d: %sunexpected %s in %sinvalid nil pointerExtensionRangeArrayfield %v is invaliddescriptor mismatchNtUnmapViewOfSectionNtWriteVirtualMemoryinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrstime: invalid numberJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeTERM_PROGRAM_VERSIONgenSignedCertWithKeyanoxxxxxxxxxxxxxxxxxaxxxxxxxxxxxxxxxxxnoinvalid username: %sno PEM data in inputerror parsing ip:" (Indicator: "CryptAcquireContextW"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "lect.Value.IsZeroreflect.Value.Methodreflect.Value.SetIntreflect.Value.Slice3invalid string tableChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetAdaptersAddressesGetWindowsDirectoryWProcessIdToSessionIdSetVolumeMountPointWNtSetInformationFileRtlInitUnicodeStringEnumProcessModulesExGetModuleFileNameExWGetModuleInformationSetupDiOpenDevRegKeySHGetKnownFolderPathUnloadKeyboardLayoutgzip: invalid headerjson: Unmarshal(nil)json: Unmarshal(nil json: error calling httplaxcontentlengthMAX_HEADER_LIST_SIZEinvalid DNS responsegetadaptersaddressesunexpected network: x509usefallbackrootsgetCert can't be nilinvalid UTF-8 stringx509: malformed spkiasn1: syntax error: number has no digitsindex of untyped nilindex of nil pointerslice of untyped nilVersion string emptyGetProcessMemoryInfobcryptprimitives.dllexpression too largeinvalid repeat count[invalid char class]java_outer_classnameuninterpreted_optionduplicate map key %v%s: invalid %v valueinvali" (Indicator: "CertFindChainInStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "eration was canceledoverflowing coordinatex509: malformed issuerzero length BIT STRINGInt.Scan: invalid verbinvalid number base %dinternal inconsistencyinvalid urn prefix: %qindex out of range: %dRtlLookupFunctionEntryreflectlite.Value.Elemexit hook invoked exitunexpected length codeerror parsing regexp: java_string_check_utf8php_metadata_namespacesha3: Write after Readidna: invalid label %qIPv4 address too shortmultiple :: in addressskipping Question Nameskipping Question Type\Device\NamedPipe\msysunexpected right parenexpected end; found %sparenthesized pipelineoneof type already setunknown parent type %TXXX_InternalExtensionsinvalid UTF-8 detected0123456789abcdefABCDEFbytes.Buffer: too largedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard Ti" (Indicator: "CertGetCertificateChain"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "ssor: %v.%sfloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard TimegenSelfSignedCertWithKey@&%?,=[]_:-+*$#!'^~;()/.GetUserDefaultLocaleNameinvalid argument to IntnWSAWaitForMultipleEventsWSAAsyncGetProtoByNumberVariantTimeToDosDateTimeDosDateTimeToVariantTimeSafeArrayAllocDescriptorOleCreatePictureIndirectUnRegisterTypeLibForUser{%06X-%04X-%04X-%04X-%X}Windows boot applicationtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sch" (Indicator: "CertFreeCertificateChain"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "Message.Clear on got %v, want *struct kindinvalid oneof descriptor cb27e3aa (May 26th, 2020)google/protobuf/api.protoinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusfailed to find ConnectEx: binary.Read: invalid type South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Time: day-of-year out of rangeincomplete escape sequencemustRegexReplaceAllLiteralAEIOUBCDFGHJKLMNPQRSTVWXYZdecoding PEM as PKCS#8: %serror pem-encoding key: %sCannot find has on type %sGetSystemDefaultLocaleNameinvalid argument to Int31nDOS Header magic not foundWSAEnumNameSpaceProvidersAWSAEnumNameSpaceProvidersWSafeArrayDestroyDescriptorSafeArrayAllocDescriptorExempty buffer in CopyB" (Indicator: "CertFreeCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "fferall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryreflect.Value.CanInterfaceinteger overflow on token 1455191522836685180664062572759576141834259033203125 using unaddressable valueunknown ABI parameter kind using zero Value argumentreflect.Value.MethodByNamereflect.Value.OverflowUintGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetFileInformationByHandleSetPr" (Indicator: "CertFindCertificateInStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "any declarations in %smismatching message lengthsinvalid Message.Mutable on %v: assigning invalid value%v %v is already registeredbytes: negative Repeat countfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextunrecognized PE machine: %#xCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard Timeunsupported compression for English name for time zone "invalid TERM_PROGRAM_VERSIONunable to decode certificateerror generating rsa key: %sCannot find first on type %sos: process already finishedGetFileInformationByHandleExWPUCompleteOverlappedRequestRISC-V 128-bit address spaceInvalid rich header checksumerrors: target cannot be nilGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangeneed padding in bucket (key)/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found api reference "ossible type kind unsafe.Slice: len out of range227373675443232059478759765625reflect: Elem of invalid type reflect: Out of non-func type reflect: unexpected GC programMapIter.Key called before NextGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceInfoListExWSetupDiGetDeviceInstallParamsWSetupDiSetDeviceInstallParamsWlooking for beginning of valuein exponent of numeric literalmime: duplicate parameter namecrypto/rsa: verification errorx509: invalid ECDSA parametersx509: SAN dNSName is malformedx509: malformed issuerUniqueIDattempt to register empty nameasn1: cannot marshal nil value%s is less than or equal to %ssubtle.XORBytes: dst too shortreflect: Len of non-array typeGODEBUG: unknown cpu feature "%s: unable to unmarshal %q: %vmissing validateFirstLine functrailing garbage after addresscalled entry on non-entry nodeunterminated raw quoted string{{continue}} ou" (Indicator: "CertDeleteCertificateFromStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "gative lenreflect.MakeSlice: negative capmergeRuneSets odd length []runeCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWjson: invalid number literal %qin literal true (expecting 'r')in literal true (expecting 'u')in literal true (expecting 'e')in literal null (expecting 'u')in literal null (expecting 'l')too many transfer encodings: %qcrypto/rsa: invalid prime valuex509: malformed GeneralizedTimecrypto/ecdh: invalid public keyx509: invalid basic constraintsx509: malformed tbs certificatex509: malformed subjectUniqueIDinvalid elliptic key public keyx509: certificate is valid for missing argument for comparisonvalue has type %s; should be %sCannot create a Decimal from %vexponent %v overflows an int32!pkcs7: unsupported algorithm %qno_standard_descriptor_accessorfield %v contains invalid UTF-8google.protobuf.FieldMask.pathszone must be a non-empty stringunterminated character constantcannot parse reserved wire typeinvalid Go type %v for field %v%T does not implement Unmarshalcannot reset invalid" (Indicator: "CertDuplicateCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "v messageresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyfail to seek to string table: %vfail to seek to symbol table: %v: day-of-year does not match daythe loaded term info file is: %scannot find password template %scrypto/aes: input not full blockWSAGetServiceClassNameByClassIdAWSAGetServiceClassNameByClassIdW!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~sync: Unlock of unlocked RWMutexsync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)GCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found api reference "v messageresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyfail to seek to string table: %vfail to seek to symbol table: %v: day-of-year does not match daythe loaded term info file is: %scannot find password template %scrypto/aes: input not full blockWSAGetServiceClassNameByClassIdAWSAGetServiceClassNameByClassIdW!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~sync: Unlock of unlocked RWMutexsync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)GCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "locconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of range142108547152020037174224853515625710542735760100185871124267578125reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of range to pointer to array with length CryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWSetupDiGetDeviceRegistryProper" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertCloseStore" (Indicator: "CertCloseStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertOpenStore" (Indicator: "CertOpenStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found api reference "syscall.CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")2c:T7b0,file/memory contains long string with (Indicator: "CertCloseStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CryptProtectData"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CryptDecodeObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CertGetNameString"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CryptUnprotectData"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CertFindCertificateInStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CertDeleteCertificateFromStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.CertCloseStore" (Indicator: "CertCloseStore"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")2d:Te73,Observed string: "crypto/aes" (Indicator: "crypto/aes") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/md5" (Indicator: "crypto/md5") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/tls" (Indicator: "crypto/tls") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/rsa" (Indicator: "crypto/rsa") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/dsaParameters" (Indicator: "crypto/dsaParameters") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/ecdh" (Indicator: "crypto/ecdh") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/x509" (Indicator: "crypto/x509") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/hmac" (Indicator: "crypto/hmac") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/ecdsa" (Indicator: "crypto/ecdsa") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/cipher" (Indicator: "crypto/cipher") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/sha256" (Indicator: "crypto/sha256") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/sha512" (Indicator: "crypto/sha512") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/ed25519" (Indicator: "crypto/ed25519") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/elliptic" (Indicator: "crypto/elliptic") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/x509/pkix" (Indicator: "crypto/x509/pkix") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/internal/hpke" (Indicator: "crypto/internal/hpke") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/internal/bigmod" (Indicator: "crypto/internal/bigmod") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "golang.org/x/crypto/bcrypt" (Indicator: "golang.org/x/crypto/bcrypt") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/internal/nistec/fiat" (Indicator: "crypto/internal/nistec/fiat") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "crypto/internal/edwards25519" (Indicator: "crypto/internal/edwards25519") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "vendor/golang.org/x/crypto/sha3" (Indicator: "vendor/golang.org/x/crypto/sha3") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: ""crypto/internal/edwards25519/field" (Indicator: ""crypto/internal/edwards25519/field") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 Observed string: "%vendor/golang.org/x/crypto/cryptobyte" (Indicator: "%vendor/golang.org/x/crypto/cryptobyte") in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac62e:T40f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to decrypt/decode data Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption2f:T4c49,Found XOR loop in file "sample.bin" at offset 66831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 645295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 646678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3179687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3179769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3571529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3593618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3593767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3598759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3598966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3600758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3600798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4336024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4360924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4360928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5001753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5783854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5791242; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5863953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7273899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7429447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7430538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7431454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7432993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7434557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7435213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7435273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7436652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7437461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7438641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7441417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7441523; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7441667; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7445904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7466400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7468004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7492688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7547720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7624848; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7742092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7846656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7992884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8296037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8328997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8469769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8473481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8475337; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8491107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8495605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8498547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8507629; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8536673; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8545731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8563375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8568587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8575233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8587669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8588985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8590647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8593159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8597055; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8597849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8598319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8599161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8600283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8601231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8602425; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8604123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8605303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8608559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8610647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8611151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8611637; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8612981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8613449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8615395; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8616061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8617129; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8617429; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8618083; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8618925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8619753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8621349; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8623157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8624229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8624475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8625077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8626235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8628049; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8628845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8630925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8631445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8632063; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8636915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8639733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8641045; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8642639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8647287; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8648559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8649087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8651439; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8657979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8658671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 375251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 375318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 375385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1352472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1352498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1401189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1401316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1403930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2440710; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2440765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2440803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2441798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2441851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2441893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2441942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2857045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2857843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2860693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2860922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2872103; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2872150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2885993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2888909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2890114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2890683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2890726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3267459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3267494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3333368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3333780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3334168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3334580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3436925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3436948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3441897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3442724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3456210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3456401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3456585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5705520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5705672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5784971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5796197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5847320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6848601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7632736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8293857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8326433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8371993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8393165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8460065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8469337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8477837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8493355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8496411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8502331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8529759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8560313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8560997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8571699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8574361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6943360; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 7396699; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 384906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 982877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1000501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1000582; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1002661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1002742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1501692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1936385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1936394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2143437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2234768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3904283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3906189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3907258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3909422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4398692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4592344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5268735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5494904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5576407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5577105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5652476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5790090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5870202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5883009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7457944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7463780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7469600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7659900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7772640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8197407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8474540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8480848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8492248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8494506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8525220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8539730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8548061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8563816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8576256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8581228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8582144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8582536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8582928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8583320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8583712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8584104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8584496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8584888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8585280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8585672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8586064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8587946; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8589794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8591054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8594436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8595028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8597054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8597848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8598316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8599156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8599844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8601228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8602416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8602862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8603456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8604706; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8605300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8606748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8608544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8614682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8615380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8616046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8616686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8618906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8619734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8620482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8620716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8622102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8625058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8626222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8626684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8629722; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8634758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8636876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8639704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8642604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8644170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8647268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8648540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8649048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8651408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8654292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8655492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8655756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8656020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8657472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8658652; code bytes = 803030:Td17,Found string "github.com/spf13/cast" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/xo/terminfo" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/google/uuid" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/gookit/color" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/edsrzf/mmap-go" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/saferwall/pe/log" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/secDre4mer/pkcs7" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/name5566/leaf/log" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/gorilla/websocket" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/shopspring/decimal" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/mattn/go-colorable" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/Masterminds/sprig/v3" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/Masterminds/semver/v3" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string "github.com/mitchellh/reflectwalk" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found string ""github.com/mitchellh/copystructure" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), file/memory contains long string with (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.init" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.Load" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.Error.Error" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.Decode" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.hasInvalidCaps" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.capLength" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"), Found string "github.com/xo/terminfo.(*decoder).readBytes" (Indicator: "github.com"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")31:T41b,Found system information discovery API: "GetSystemInfo" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6" Found system information discovery API: "GetEnvironmentStringsW" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6" Found system information discovery API: "QuerySystemInformation (in long string)" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"32:T55e,"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e000397111000000f80e790000007900b012790095e163773c5e1a00feffffff0000000066000000ccf313001100000000007900f80e7900ccf31300145c6777435c677760b56e77020000000c027900000079005001790000020000000000005001790070f51300a401697728f313006600000000f8677750017900141339717827790000000000770000003ff00000110000000000000000000000e81e220064f313000000000077000077c40079000e01000f7665437269746963000000007f0000006e0000690e01000f7827790001000000000000000200000008000000 (UID: 00000000-00002512) "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512)33:T540,file/memory contains long string with (Indicator: "FindNextVolume"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FindVolumeClose"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FindFirstVolume"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetVolumePathName"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetVolumeMountPoint"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FindNextVolumeMountPoint"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FindVolumeMountPointClose"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FindFirstVolumeMountPoint"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetVolumePathNamesForVolumeName"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")34:T44d,"TkoVPzYotBTxjrJzMdBUWRfzoedHbSPxGyeEQhIjapzZbAvrufSDBvOgdqjVxJuizjeWGetQLjcTDRUiNTCTHmMaeqRLTRBDPUCDIbPknbKLhaaZRLcTcDHUXLoFCZKeFyAzjwPIHWHJFtocxUwFbIvnpmdUuxsHUibasWpTKlFmlkBqOQeiCXddKghhVFCXnUpxwhoKPXOyWVwcAYvxWTFrCzrPokJABRaEnvnfwyHuaWVzWGbXBZjvdkiNMtZdMSazxrzWfysvkbiGDrctUBoqGNnWAWwtBGkYWMvXSjOTJEJihLpbilanyrIIWXiUZzusRjbytsQzXPCGePOJUouhSAUMCSMBeaWafzPCeKJnGdePParapJXJFUXFVyqrPINRukTNQClUjQNdCpTwQiPCkYxKwxFsqQqOYhCYBRMZxHTNiBDvlNZjbougFQHIuwdGGKvhwEBIxNBkzPeFxlXZYNCAXEsBtFpxEoelnwYrlFiiHWnCCUhFQnYkZTgkScPKwDrFmRyYUOyIlSJIEPbZZtvDScccBgZtZuKvhXCNSZkXroadGaTpcMQiMRrqyHnGeXPDsECCxjNlPMzaKZNFhczFGSLsMNLeRFZSOnBnxZbfsMHQMZmALHetDroSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonessupport True Color on windows version is >= build 14931error processing alternate dns name: %v is not a stringcipher.NewCBCEncrypter: IV length must equal block sizecipher.NewCBCDecrypter: IV length must equal block sizeExport directory contains more than max ordinal entriesinvalid NT Header Offset. NT Header Signature not foun" in Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac635:T10e0,"github.com/spf13/cast" (Indicator: "github.com") "github.com/xo/terminfo" (Indicator: "github.com") "github.com/google/uuid" (Indicator: "github.com") "github.com/gookit/color" (Indicator: "github.com") "github.com/edsrzf/mmap-go" (Indicator: "github.com") "github.com/saferwall/pe/log" (Indicator: "github.com") "github.com/secDre4mer/pkcs7" (Indicator: "github.com") "github.com/name5566/leaf/log" (Indicator: "github.com") "github.com/gorilla/websocket" (Indicator: "github.com") "github.com/shopspring/decimal" (Indicator: "github.com") "github.com/mattn/go-colorable" (Indicator: "github.com") "github.com/Masterminds/sprig/v3" (Indicator: "github.com") "github.com/Masterminds/semver/v3" (Indicator: "github.com") "github.com/mitchellh/reflectwalk" (Indicator: "github.com") ""github.com/mitchellh/copystructure" (Indicator: "github.com"), "pathEfEizEIzDlmodEfEizEIzDl(devel)depdario.cat/mergov1.0.1h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=depgithub.com/Masterminds/goutilsv1.1.1h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=depgithub.com/Masterminds/semver/v3v3.3.0h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=depgithub.com/Masterminds/sprig/v3v3.3.0h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=depgithub.com/edsrzf/mmap-gov1.1.0h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ=depgithub.com/fatih/colorv1.17.0h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=depgithub.com/google/cel-gov0.21.0h1:cl6uW/gxN+Hy50tNYvI691+sXxioCnstFzLp2WO4GCI=depgithub.com/google/uuidv1.6.0h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=depgithub.com/googleapis/enterprise-certificate-proxyv0.3.4h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=depgithub.com/gookit/colorv1.5.4h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=depgithub.com/gorilla/websocketv1.5.3h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=depgithub.com/gosu" (Indicator: "github.com"), "i/uitablev0.0.4h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=depgithub.com/hashicorp/go-envparsev0.1.0h1:bE++6bhIsNCPLvgDZkYqo3nA+/PFI51pkrHdmPSDFPY=depgithub.com/huandu/xstringsv1.5.0h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=depgithub.com/influxdata/influxdb1-clientv0.0.0-20220302092344-a9ab5670611ch1:qSHzRbhzK8RdXOsAdfDgO49TtqC1oZ+acxPrkfTxcCs=depgithub.com/jeandeaual/go-localev0.0.0-20240223122105-ce5225dcaa49h1:Po+wkNdMmN+Zj1tDsJQy7mJlPlwGNQd9JZoPjObagf8=depgithub.com/klauspost/compressv1.17.9h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=depgithub.com/maengsanha/instacrawlerv0.0.0-20230727163850-eee38b25ac0eh1:fAMgrdRIy3agqipYvv6+m9bK1+4FljWDv+asyxjowU4=depgithub.com/mattn/go-colorablev0.1.13h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=depgithub.com/mattn/go-isattyv0.0.20h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=depgithub.com/mattn/go-runewidthv0.0.16h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=depgithub.com/mitchellh/copystructurev1.2.0h1:vpKXTN4" (Indicator: "github.com"), "wci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=depgithub.com/mitchellh/reflectwalkv1.0.2h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=depgithub.com/moby/lockerv1.0.1h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=depgithub.com/name5566/leafv0.0.0-20221021105039-af71eb082cdah1:5S+9luohX8Whu/4VreRe4E0bHSSuJ4hyIGJc1nvNQzQ=depgithub.com/rivo/unisegv0.2.0h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=depgithub.com/saferwall/pev1.5.4h1:tLmMggEMUfeqrpJ25zS/okUQmyFdD5xWKL2+z9njCqg=depgithub.com/secDre4mer/pkcs7v0.0.0-20240322103146-665324a4461dh1:RQqyEogx5J6wPdoxqL132b100j8KjcVHO1c0KLRoIhc=depgithub.com/shopspring/decimalv1.4.0h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=depgithub.com/spf13/castv1.7.0h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=depgithub.com/vmware/govmomiv0.43.0h1:7Kg3Bkdly+TrE67BYXzRq7ZrDnn7xqpKX95uEh2f9Go=depgithub.com/xo/terminfov0.0.0-20210125001918-ca9a967f8778h1:QldyIu/L63oPpyvQmHgvgickp1Yw510KJOqX7H24mg8=depgolang.org/x/cryptov0.26.0h1:RrRspgV4mU+YwB4FYnu" (Indicator: "github.com"), "github.com/xo/terminfo.init" (Indicator: "github.com"), "github.com/xo/terminfo.Load" (Indicator: "github.com"), "github.com/xo/terminfo.Error.Error" (Indicator: "github.com"), "github.com/xo/terminfo.Decode" (Indicator: "github.com"), "github.com/xo/terminfo.hasInvalidCaps" (Indicator: "github.com"), "github.com/xo/terminfo.capLength" (Indicator: "github.com"), "github.com/xo/terminfo.(*decoder).readBytes" (Indicator: "github.com")36:T778,"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")37:Tc50,"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "C2588125970DB20AC97818D2170EECEC857F578D7BF3F24EF8F6A3F303798AC6"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")38:Tcdc,"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\bcryptprimitives.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\bcrypt.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "\Device\KsecDD" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\FLTLIB.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\MSVCP140.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\VCRUNTIME140.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\ucrtbase.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll"39:Tcf7,"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\MSVCP140.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\ucrtbase.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3a:T6af,file/memory contains long string with (Indicator: "inet_ntoa"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "inet_addr"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "wsastartup"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "wsacleanup"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "gethostname"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "__wsafdisset"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "gethostbyname"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "wsagetlasterror"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: " send "; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: " socket "; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "github.com/Masterminds/sprig/v3.getHostByName" (Indicator: "gethostbyname"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")3b:T8c5,file/memory contains long string with (Indicator: "NetUserEnum"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetUserName"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NtQueryObject"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "WTSQueryUserToken"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "LookupAccountName"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "NtQueryInformationProcess"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.LookupAccountSid" (Indicator: "LookupAccountSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")3c:T941,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "Thread32Next"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "EnumProcesses"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "Module32Next"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "Thread32First"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "Process32Next"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "Module32First"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "Process32First"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "EnumProcessModules"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "QueryInformationProcess"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")3d:Tbf7,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetTempPath"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetFileVersionInfo"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetFileVersionInfoSize"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetTempPath" (Indicator: "GetTempPath"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "internal/syscall/windows.GetTempPath2" (Indicator: "GetTempPath"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "golang.org/x/sys/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")3e:T17d9,file/memory contains long string with (Indicator: "GetAce"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CopySid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "FreeSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "EqualSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "IsValidSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetLengthSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "RevertToSelf"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "IsWellKnownSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "DuplicateToken"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetEntriesInAcl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "AdjustTokenGroups"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "IsTokenRestricted"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "CreateWellKnownSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "InitializeSid"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "IsValidSecurityDescriptor"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorLength"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetSecurityDescriptorControl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6") Found reference to API "syscall.GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6")3f:T65e,Found string "trunc" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: UCRTBASE.DLL) Found string "signal" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: UCRTBASE.DLL) Found string "remove" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: UCRTBASE.DLL) Found string "accept" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: WS2_32.DLL) Found string "connect" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: WS2_32.DLL) Found string "tmpfile" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: UCRTBASE.DLL) Found string "sprintf" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: MSVCRT.DLL) Found string "shutdown" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: WS2_32.DLL) Found string "WSAIoctl" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: WS2_32.DLL) Found string "unexpected" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: UCRTBASE.DLL) Found string "GetFileType" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: KERNELBASE.DLL) Found string "GetCertificate" (Source: c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6, API is part of module: GDI32.DLL)40:T61a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "onePackage.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "onePackage.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "onePackage.exe") file/memory contains long string with (Indicator: "VirtualFree"; File: "onePackage.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "onePackage.exe") file/memory contains long string with (Indicator: "FreeMemory"; File: "onePackage.exe") file/memory contains long string with (Indicator: "VirtualAllocEx"; File: "onePackage.exe") file/memory contains long string with (Indicator: "WriteVirtualMemory"; File: "onePackage.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp")41:T4a2,file/memory contains long string with (Indicator: "GetUserDefaultLocaleName"; File: "onePackage.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007096.00000000.201608.05800000.00000004.mdmp, 00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp")42:Tb9c,"onePackage.exe" queries volume information of "C:\onePackage.exe" at 00000000-00007096-00000C15-2153803823 "onePackage.exe" queries volume information of "C:\Windows" at 00000000-00007096-00000C15-2158956560 "onePackage.exe" queries volume information of "C:\Windows\AppReadiness" at 00000000-00007096-00000C15-2158957400 "onePackage.exe" queries volume information of "C:\Windows\BitLockerDiscoveryVolumeContents" at 00000000-00007096-00000C15-2158957979 "onePackage.exe" queries volume information of "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" at 00000000-00007096-00000C15-2160251407 "onePackage.exe" queries volume information of "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" at 00000000-00007096-00000C15-2160442204 "onePackage.exe" queries volume information of "C:\Windows\Boot" at 00000000-00007096-00000C15-2162160999 "onePackage.exe" queries volume information of "C:\Windows\Boot\DVD" at 00000000-00007096-00000C15-2162162002 "onePackage.exe" queries volume information of "C:\Windows\Boot\DVD\EFI" at 00000000-00007096-00000C15-2162162437 "onePackage.exe" queries volume information of "C:\Windows\Boot\DVD\EFI\en-US" at 00000000-00007096-00000C15-2162163287 "onePackage.exe" queries volume information of "C:\Windows\Boot\DVD\PCAT" at 00000000-00007096-00000C15-2162164176 "onePackage.exe" queries volume information of "C:\Windows\Boot\DVD\PCAT\en-US" at 00000000-00007096-00000C15-2162165434 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI" at 00000000-00007096-00000C15-2162166243 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\bg-BG" at 00000000-00007096-00000C15-2162166775 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\cs-CZ" at 00000000-00007096-00000C15-2162168433 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\da-DK" at 00000000-00007096-00000C15-2162169768 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\de-DE" at 00000000-00007096-00000C15-2162170801 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\el-GR" at 00000000-00007096-00000C15-2162171854 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\en-GB" at 00000000-00007096-00000C15-2162172868 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\en-US" at 00000000-00007096-00000C15-2162173677 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\es-ES" at 00000000-00007096-00000C15-2162174711 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\es-MX" at 00000000-00007096-00000C15-2162175765 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\et-EE" at 00000000-00007096-00000C15-2162176653 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\fi-FI" at 00000000-00007096-00000C15-2162177506 "onePackage.exe" queries volume information of "C:\Windows\Boot\EFI\fr-CA" at 00000000-00007096-00000C15-216217853043:T4a8,"onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\Boot\PCAT\memtest.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\InfusedApps\Packages\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\InfusedApps\Packages\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.News.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\InfusedApps\Packages\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Sports.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32Info.exe" - (UID: 00000000-00007096)44:T4a3,"onePackage.exe" loaded module "KERNEL32" at base 76730000 "onePackage.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74730000 "onePackage.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74730000 "onePackage.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74730000 "onePackage.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75dc0000 "onePackage.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74730000 "onePackage.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74730000 "onePackage.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74730000 "onePackage.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737b0000 "onePackage.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 74d40000 "onePackage.exe" loaded module "NTDLL.DLL" at base 77bb0000 "onePackage.exe" loaded module "WINMM.DLL" at base 735a0000 "onePackage.exe" loaded module "POWRPROF.DLL" at base 75d20000 "onePackage.exe" loaded module "KERNEL32.DLL" at base 76730000 "onePackage.exe" loaded module "WS2_32.DLL" at base 76800000 "onePackage.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7452000045:T4a1,Observed system executable string:"%WINDIR%\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" [Source: 00000000-00007096-00000BC0-2161324265] Observed system executable string:"%WINDIR%\Boot\PCAT\memtest.exe" [Source: 00000000-00007096-00000BC0-2164078308] Observed system executable string:"%WINDIR%\InfusedApps\Packages\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe" [Source: 00000000-00007096-00000BC0-2174051653] Observed system executable string:"%WINDIR%\InfusedApps\Packages\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.News.exe" [Source: 00000000-00007096-00000BC0-2179258592] Observed system executable string:"%WINDIR%\InfusedApps\Packages\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Sports.exe" [Source: 00000000-00007096-00000BC0-2181960249] Observed system executable string:"%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32.exe" [Source: 00000000-00007096-00000BC0-2297177056] Observed system executable string:"%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32Info.exe" [Source: 00000000-00007096-00000BC0-2299864942]46:Tcaf,file/memory contains long string with (Indicator: "GetDesktopWindow"; File: "onePackage.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007096.00000002.205448.05A80000.00000004.mdmp, 00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007096.00000002.205448.05A80000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007096.00000002.205448.05A80000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007096.00000002.205448.05A80000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007096.00000002.205448.05A80000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp")47:T8b0,file/memory contains long string with (Indicator: "RegOpenKey"; File: "onePackage.exe") file/memory contains long string with (Indicator: "RegEnumKey"; File: "onePackage.exe") file/memory contains long string with (Indicator: "RegEnumValue"; File: "onePackage.exe") file/memory contains long string with (Indicator: "RegQueryValue"; File: "onePackage.exe") file/memory contains long string with (Indicator: "RegQueryInfoKey"; File: "onePackage.exe") file/memory contains long string with (Indicator: "RegNotifyChangeKeyValue"; File: "onePackage.exe") Found reference to API "syscall.RegOpenKeyEx" (Indicator: "RegOpenKey"; File: "onePackage.exe") Found reference to API "syscall.RegQueryValueEx" (Indicator: "RegQueryValue"; File: "onePackage.exe") Found reference to API "syscall.RegEnumKeyEx" (Indicator: "RegEnumKey"; File: "onePackage.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp")48:T84b,file/memory contains long string with (Indicator: "NetUserEnum"; File: "onePackage.exe") file/memory contains long string with (Indicator: "GetUserName"; File: "onePackage.exe") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "onePackage.exe") file/memory contains long string with (Indicator: "NtQueryObject"; File: "onePackage.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "onePackage.exe") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "onePackage.exe") file/memory contains long string with (Indicator: "WTSQueryUserToken"; File: "onePackage.exe") file/memory contains long string with (Indicator: "LookupAccountName"; File: "onePackage.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "onePackage.exe") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "onePackage.exe") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "onePackage.exe") file/memory contains long string with (Indicator: "NtQueryInformationProcess"; File: "onePackage.exe") Found reference to API "syscall.GetTokenInformation" (Indicator: "GetTokenInformation"; File: "onePackage.exe") Found reference to API "syscall.LookupAccountSid" (Indicator: "LookupAccountSid"; File: "onePackage.exe") Found reference to API "syscall.OpenProcessToken" (Indicator: "OpenProcessToken"; File: "onePackage.exe") Found reference to API "syscall.NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "onePackage.exe") Found reference to API "syscall.NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "onePackage.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007096.00000002.205448.06680000.00000004.mdmp")49:T9d6,"onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "onePackage.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4a:T4a8,"onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\Boot\PCAT\memtest.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\InfusedApps\Packages\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\InfusedApps\Packages\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.News.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\InfusedApps\Packages\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Sports.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32.exe" - (UID: 00000000-00007096) "onePackage.exe" called "CreateProcessW" with parameter "%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32Info.exe" - (UID: 00000000-00007096)4b:T7fc,"onePackage.exe" wrote 00000004 bytes to a remote process "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" (Handle: 524) "onePackage.exe" wrote 00000400 bytes to a remote process "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" (Handle: 524) "onePackage.exe" wrote 00000004 bytes to a remote process "C:\Windows\InfusedApps\Packages\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe" (Handle: 548) "onePackage.exe" wrote 00000400 bytes to a remote process "C:\Windows\InfusedApps\Packages\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe" (Handle: 548) "onePackage.exe" wrote 00000004 bytes to a remote process "C:\Windows\InfusedApps\Packages\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.News.exe" (Handle: 584) "onePackage.exe" wrote 00000400 bytes to a remote process "C:\Windows\InfusedApps\Packages\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.News.exe" (Handle: 584) "onePackage.exe" wrote 00000004 bytes to a remote process "C:\Windows\InfusedApps\Packages\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Sports.exe" (Handle: 592) "onePackage.exe" wrote 00000400 bytes to a remote process "C:\Windows\InfusedApps\Packages\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Sports.exe" (Handle: 592) "onePackage.exe" wrote 00000004 bytes to a remote process "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32.exe" (Handle: 692) "onePackage.exe" wrote 00000400 bytes to a remote process "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32.exe" (Handle: 692) "onePackage.exe" wrote 00000004 bytes to a remote process "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32Info.exe" (Handle: 756) "onePackage.exe" wrote 00000400 bytes to a remote process "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\AcroRd32Info.exe" (Handle: 756)4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAABEzEAAAAAAAAAAAAAAAAAERMzMQAAAAAAAAAAAAAAARETMzMxEAAAAAAAAAAAABEREzMzMzMQAAAAAAAAAAERERMzMzMzMxEAAAAAAAERERETMRERMzMzAAAAAAARERERERE3MRERERAAAAAAERERERERd3cxEREQAAAAABERERERE3d3d3MREAAAAAARNzERETd3d3d3dzcAAAAAE3d3cRM3d3d3d3d3cAAAA3d3d3dzN3d3d3d3d3AAAHd3d3d3IiMzd3d3d3dwAAd3d3d3MiIiIjd3d3d3AAB3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3dzN3AAAAd3dzd3d3d3d3d3czNwAAAAd3Mzd3d3dwd3d3N3iAAAAAd3M3cAdyAHcAd3d4iAAAAHd3d3d3d3d3d3d3iIiAAAiIh3d3d3d3d3d3eIiIgAAIiId3d3d3d3d3d3iIiAAAAIiIiIiIiId3d3eIiAAAAAAAiIiIiIiAd3d3iIAAAAAAAAAIiIiIAAB3eIAAAAAAAAAAAACIgAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////D////gH///wAf//wAA//4AAD/8AAAP+AAAB/AAAAfgAAAH4AAAB+AAAA/4AAAP+AAAB/gAAAPwAAAD4AAAA8AAAAeAAAAHAAAAD8AAAA/gAAAH8AAAA/AAAAHgAAAB4AAAA/AAAA/8AEAf/4Dwf//x/f///////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790908523985,"unified_at":"2026-10-02T02:35:23.985Z","metadata":{"hashes":{"sha256":"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6","sha1":"e9e14a284fae52c5c91200f81af4f94b53526816","md5":"6c2db0ef90b27f880a1566de7711e6c6","sha512":"1a9a1220958cc5b9d32dc70074df174eae7040c53bbf1fa4c97753a9f8c2a9a8c20668fc957d743fb038a97ca0017e333181856a783e10cfae0f557d2aab73a2","ssdeep":"98304:f7aVHGolaJtFaKWi64a6kI/t5jeWjAmiEmp71:mtl0Fh7Lk","ssdeep_chunks":["98304:f7aVHGo","98304:7aVHGol","98304:aVHGola","98304:VHGolaJ","98304:HGolaJt","98304:GolaJtF","98304:olaJtFa","98304:laJtFaK","98304:aJtFaKW","98304:JtFaKWi","98304:tFaKWi6","98304:FaKWi64","98304:aKWi64a","98304:KWi64a6","98304:Wi64a6k","98304:i64a6kI","98304:64a6kI/","98304:4a6kI/t","98304:a6kI/t5","98304:6kI/t5j","98304:kI/t5je","98304:I/t5jeW","98304:/t5jeWj","98304:t5jeWjA","98304:5jeWjAm","98304:jeWjAmi","98304:eWjAmiE","98304:WjAmiEm","98304:jAmiEmp","98304:AmiEmp7","98304:miEmp71","196608:f7aVHGo","196608:7aVHGol","196608:aVHGola","196608:VHGolaJ","196608:HGolaJt","196608:GolaJtF","196608:olaJtFa","196608:laJtFaK","196608:aJtFaKW","196608:JtFaKWi","196608:tFaKWi6","196608:FaKWi64","196608:aKWi64a","196608:KWi64a6","196608:Wi64a6k","196608:i64a6kI","196608:64a6kI/","196608:4a6kI/t","196608:a6kI/t5","196608:6kI/t5j","196608:kI/t5je","196608:I/t5jeW","196608:/t5jeWj","196608:t5jeWjA","196608:5jeWjAm","196608:jeWjAmi","196608:eWjAmiE","196608:WjAmiEm","196608:jAmiEmp","196608:AmiEmp7","196608:miEmp71","98304:mtl0Fh7","98304:tl0Fh7L","98304:l0Fh7Lk"],"imphash":"1aae8bf580c846f39c71c05898e57e88"},"file_info":{"file_name":"onePackage.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":8732672,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1726636807000,"last_seen":1788880224000,"last_multi_scan":1788880224000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":222,"suspicious_count":14,"malicious_count":8,"total":244},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.LummaC2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Sabsik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.38226242","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_LummaStealer_RPB_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.38226242 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/TrojanDropper.Agent.EK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wacatac.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/W64.Agent.ar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d01cf1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_anti_VM_strings_targeting_VMWare","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Inject-JQY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.KWNG-8962","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WKV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Agent.Win32.601424","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Possibly references Golang binary related string"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to perform archive via gzip Library"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\" Go build ID: \"6uxlYIGKZaBdfE414nB4/hyeLX287bWA-c9i92tWV/6QHBJx2a7kuvfIb7gsMx/si6ScZ3IT9pX3rgitA03\"\n \" (Indicator: \" Go build ID: \"6uxlYIGKZaBdfE414nB4/hyeLX287bWA-c9i92tWV/6QHBJx2a7kuvfIb7gsMx/si6ScZ3IT9pX3rgitA03\"\n )\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-74","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*big.int\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.7.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"password\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"chacha8\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"aesKey\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAllocEx\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ResumeThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"SetThreadToken\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"golang.org/x/sys/windows.LoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"golang.org/x/sys/windows._LoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ControlService\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ChangeServiceConfig\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"file/memory contains long string with (Indicator: \"UnmapViewOfSection\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"SHA384\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"SHA512\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to \"github.com/saferwall/pe.parseHashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to \"main.oynSeTmXKvABvnIGhluysQiOhuAWRiAesUGNtIuHlnjoJcJO\" (Indicator: \"Aes\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to \"main.QfXOidCbWLXwOryauiKBeAsmscpviYfUVyGtzRHpoIqLiJIdIewEHN\" (Indicator: \"Oid\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"encoding/base64.(*Encoding).DecodeString\" (Indicator: \".decodestring\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"crypto/aes.decryptBlockGo\" (Indicator: \".decrypt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"crypto/aes.(*aesCipher).Decrypt\" (Indicator: \".decrypt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"crypto/rsa.decrypt\" (Indicator: \".decrypt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"encoding/base32.(*Encoding).DecodeString\" (Indicator: \".decodestring\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"github.com/Masterminds/sprig/v3.decryptAES\" (Indicator: \".decrypt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to perform archive via gzip Library","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-725","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n 01h in Stream UID: 20663-56279-005D7490","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"file/memory contains long string with (Indicator: \"CryptAcquireCertificatePrivateKey\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"EncryptedKey\" (Indicator: \"encryptedkey\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"public key\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"private key\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$30","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveTypeW\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetLogicalDrives\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetLogicalDriveStringsW\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"FreeSid\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserDefaultLocaleName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetDiskFreeSpaceEx\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"file/memory contains long string with (Indicator: \"setupdienumdeviceinfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"setupdigetclassdevs\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetKeyboardLayout\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetUserPreferredUILanguages\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"enumwindows\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"enumchildwindows\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetFileTime\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"file/memory contains long string with (Indicator: \"EnumWindows\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetForegroundWindow\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowsDirectory\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"izer waitsync.Cond.Waits.allocCount= key size wrongnil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/syscall/windows.GetVolumeInformationByHandle\" (Indicator: \"GetVolumeInformation\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"EnumServicesStatus\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"EnumDependentServices\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"GetProcAddress\" with a parameter timeBeginPeriod (UID: 00000000-00002512)\n \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002512)\n \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" called \"GetProcAddress\" with a parameter timeEndPeriod (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"file/memory contains long string with (Indicator: \"CloseServiceHandle\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.CreateProcessAsUser\" (Indicator: \"CreateProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.CreateProcess\" (Indicator: \"CreateProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"golang.org/x/sys/windows.CreateFileMapping\" (Indicator: \"CreateFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadResource\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"LockResource\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"FindResource\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"SizeofResource\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ResumeThread\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"SetLastError\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetShellWindow\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"StartServiceCtrlDispatcher\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"user-agent: \"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$35","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74C00000\n \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75040000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75930000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0f00100028f20501@winmm.dll\"\n \"0d000e0037df0501@winmm.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" has an writable section named \".data\"\n \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" file has an entrypoint instructions - \"jmp\t0x470f50,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tdword ptr [esp], eax,mov\tdword ptr [esp + 4], ecx,call\t0x44cc10,mov\teax, dword ptr [esp + 8],mov\tedi, dword ptr [esp + 0x18],mov\tesi, dword ptr [esp + 0x14],mov\tebp, dword ptr [esp + 0x10],mov\tebx, dword ptr [esp + 0x1c],add\tesp, 0x28,ret\t4,ret\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 8,mov\tecx, dword ptr [esp + 0xc],mov\tedx, dword ptr [ecx],mov\teax, esp,mov\tdword ptr [edx + 4], eax,sub\teax, 0x10000,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x3daa00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x3f0600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x3da9a8\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x3f0544\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 465129)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"CreateService\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"RegisterServiceCtrlHandler\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"golang.org/x/sys/windows.LoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"golang.org/x/sys/windows._LoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to retrieve information set for devices (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.Setsockopt\" (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/poll.(*FD).SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/poll.(*FD).SetsockoptInt.deferwrap1\" (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ConnectNamedPipe\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetNamedPipe\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.CreatePipe\" (Indicator: \"CreatePipe\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserEnum\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://protobuf.dev\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"GetDesktopWindow\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"izer waitsync.Cond.Waits.allocCount= key size wrongnil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"golang.org/x/sys/windows.RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry query API: \"RegNotifyChangeKeyValue (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry query API: \"syscall.RegOpenKeyEx\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry query API: \"syscall.RegQueryValueEx\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry query API: \"syscall.RegEnumKeyEx\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveType\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetLogicalDrives\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetLogicalDriveStrings\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.FindFirstFile\" (Indicator: \"FindFirstFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/syscall/windows.GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/syscall/windows.GetComputerNameEx\" (Indicator: \"GetComputerName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"file/memory contains long string with (Indicator: \"gethostname\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.getsockname\" (Indicator: \"getsockname\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"file/memory contains long string with (Indicator: \"DllGetClassObject\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"file/memory contains long string with (Indicator: \"\\Device\\\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"file/memory contains long string with (Indicator: \"CoGetObject\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"file/memory contains long string with (Indicator: \"DefineDosDevice\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n Found reference to API \"syscall.NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"InitiateSystemShutdown\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"file/memory contains long string with (Indicator: \"OpenMutex\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"CreateMutex\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")\n file/memory contains long string with (Indicator: \"ReleaseMutex\"; File: \"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".symtab\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6.exe queries ProcessDebugPort (UID: 2512)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/24 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n WriteFile\n GetThreadContext\n CreateThread\n GetProcAddress\n LoadLibraryW\n VirtualAlloc\n GetSystemDirectoryA\n LoadLibraryExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"},{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/24 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa0255ed8a7f4c3300a229c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAllocEx\"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007096.00000000.201608.007A0000.00000004.mdmp, 00000000-00007096.00000001.203526.007A0000.00000004.mdmp, 00000000-00007096.00000002.205448.007A0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007096.00000002.205448.05A80000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"onePackage.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"QuerySystemInformation\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"ExpandEnvironmentStrings\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"RtlNtStatusToDosError\"; File: \"onePackage.exe\")\n Found reference to API \"GetMonitorInfoA\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"onePackage.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetKeyboardLayout\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"GetUserPreferredUILanguages\"; File: \"onePackage.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"onePackage.exe\" has section name .rdata with entropy \"6.17101532295\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$43","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"onePackage.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter bcryptprimitives.dll (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter winmm.dll (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter powrprof.dll (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007096)\n \"onePackage.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00007096)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"file/memory contains long string with (Indicator: \"RegCreateKey\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"RegLoadMUIString\"; File: \"onePackage.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"onePackage.exe\")\n Found reference to API \"syscall.OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"onePackage.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"user-agent: \"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$45","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"BitLockerToGo.exe\" (UID: 00000000-00007580) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"BitLockerToGo.exe\" (UID: 00000000-00007580) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"onePackage.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"onePackage.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"onePackage.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"BitLockerToGo.exe\" (UID: 00000000-00007580)\n Spawned process \"memtest.exe\" (UID: 00000000-00004172)\n Spawned process \"Microsoft.Msn.Money.exe\" (UID: 00000000-00006596)\n Spawned process \"Microsoft.Msn.News.exe\" (UID: 00000000-00007260)\n Spawned process \"Microsoft.Msn.Sports.exe\" (UID: 00000000-00006708)\n Spawned process \"AcroRd32.exe\" (UID: 00000000-00000696)\n Spawned process \"AcroRd32Info.exe\" (UID: 00000000-00000812)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"BitLockerToGo.exe\" (UID: 00000000-00007580)\n Spawned process \"memtest.exe\" (UID: 00000000-00004172)\n Spawned process \"Microsoft.Msn.Money.exe\" (UID: 00000000-00006596)\n Spawned process \"Microsoft.Msn.News.exe\" (UID: 00000000-00007260)\n Spawned process \"Microsoft.Msn.Sports.exe\" (UID: 00000000-00006708)\n Spawned process \"AcroRd32.exe\" (UID: 00000000-00000696)\n Spawned process \"AcroRd32Info.exe\" (UID: 00000000-00000812)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 465129)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"onePackage.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"onePackage.exe\" queries basic process information of the \"C:\\onePackage.exe\" (UID: 7096)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"onePackage.exe\" reads file \"c:\\onepackage.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\bitlockerdiscoveryvolumecontents\\bitlockertogo.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\boot\\pcat\\memtest.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\helppane.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\immersivecontrolpanel\\systemsettings.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\builder3d.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\microsoft.msn.money.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\infusedapps\\packages\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\microsoft.msn.news.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\infusedapps\\packages\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\microsoft.msn.sports.exe\"\n \"onePackage.exe\" reads file \"c:\\windows\\infusedapps\\packages\\microsoft.bingweather_4.21.2492.0_x64__8wekyb3d8bbwe\\microsoft.msn.weather.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\".relocMIPS16NativeStringCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidisysmontimersefence, not object next= jobs= goid sweep B -> % util alloc free span= prev= list=, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base structFormat[]byte' for 390625uint16uint32uint64chan<-<-chan ValueGetAceGetACPSTRINGX25519activeclosedsocks5Basic CookiecookieexpectservermethodExpectPragmanetdnsdomaingophertelnetreturn.local.onionip+net[%d]%sexec: STREET-----scriptprintf'\"&<>\" (Indicator: \".onion\") in Source: onePackage.exe","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFileExA\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007096.00000000.201608.007A0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007096.00000001.203526.007A0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007096.00000002.205448.007A0000.00000004.mdmp\")\n Found URL \"https://watson.microsoft.com/dw/dcp.asphttps://watson.microsoft.com/dw/watsoninfo.aspreportingnot\" - Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found URL \"http://https://user32getsystemmetricsmonitorfromwindowmonitorfromrectmonitorfrompointenumdisplaymonitorsgetmonitorinfoaenumdisplaydevicesadisplaydwdebugbreaksoftware\\microsoft\\pchealth\\errorreporting\\dw\\debug%s\\%sdrwtsn32drwatsonmsodwexclusive%ihttphttpslaunching\" - Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"onePackage.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007096.00000002.205448.05A80000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007096.00000002.205448.05A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveType\"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"file/memory contains long string with (Indicator: \"GetLogicalDrives\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"GetLogicalDriveStrings\"; File: \"onePackage.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007096.00000002.205448.05A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007096.00000000.201608.05800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"onePackage.exe\")\n Found reference to API \"izer waitsync.Cond.Waits.allocCount= key size wrongnil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007096.00000002.205448.05A80000.00000004.mdmp, 00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegDeleteKey\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"RegDeleteValue\"; File: \"onePackage.exe\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"onePackage.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"onePackage.exe\" has section name .text with entropy \"6.02603821476\"\n \"onePackage.exe\" has section name .rdata with entropy \"6.17101532295\"\n \"onePackage.exe\" has section name .reloc with entropy \"6.64599345782\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"terminfo@v0.0.0\"\n Pattern match: \"sys@v0.23.0\"\n Pattern match: \"color@v1.5.4\"\n Pattern match: \"protobuf@v1.33.0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%WINDIR%\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe\" spawned likely due to injection\n Process \"%WINDIR%\\Boot\\PCAT\\memtest.exe\" spawned likely due to injection\n Process \"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe\" spawned likely due to injection\n Process \"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe\" spawned likely due to injection\n Process \"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe\" spawned likely due to injection\n Process \"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA7DA73301B744BA0000000010\\11.0.0\\AcroRd32.exe\" spawned likely due to injection\n Process \"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA7DA73301B744BA0000000010\\11.0.0\\AcroRd32Info.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007096.00000002.205448.06680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Hostname\" (Indicator: \"hostname\"; File: \"onePackage.exe\")\n file/memory contains long string with (Indicator: \"route\"; File: \"onePackage.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"$4a","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"onePackage.exe\" set thread context in remote process \"%WINDIR%\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe\" (PID: 1d9c)\n \"onePackage.exe\" set thread context in remote process \"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe\" (PID: 19c4)\n \"onePackage.exe\" set thread context in remote process \"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe\" (PID: 1c5c)\n \"onePackage.exe\" set thread context in remote process \"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe\" (PID: 1a34)\n \"onePackage.exe\" set thread context in remote process \"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA7DA73301B744BA0000000010\\11.0.0\\AcroRd32.exe\" (PID: 2b8)\n \"onePackage.exe\" set thread context in remote process \"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA7DA73301B744BA0000000010\\11.0.0\\AcroRd32Info.exe\" (PID: 32c)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"onePackage.exe\" (UID: 00000000-00007096)\n Spawned process \"BitLockerToGo.exe\" (UID: 00000000-00007580)\n Spawned process \"memtest.exe\" (UID: 00000000-00004172)\n Spawned process \"Microsoft.Msn.Money.exe\" (UID: 00000000-00006596)\n Spawned process \"Microsoft.Msn.News.exe\" (UID: 00000000-00007260)\n Spawned process \"Microsoft.Msn.Sports.exe\" (UID: 00000000-00006708)\n Spawned process \"AcroRd32.exe\" (UID: 00000000-00000696)\n Spawned process \"AcroRd32Info.exe\" (UID: 00000000-00000812)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":56,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6aa0255ed8a7f4c3300a229c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6","analysis_start_time":"2026-09-08T15:10:25+00:00","indicators_count":{"informative":171,"suspicious":9,"malicious":3},"is_in_unified_schema":true},{"id":"66ea6dd70c8ff88d1406a007","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"onePackage.exe","analysis_start_time":"2024-09-18T06:06:16+00:00","indicators_count":{"informative":176,"suspicious":22,"malicious":4},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66ea6dd70c8ff88d1406a007"}],"processes":[{"pid":7096,"ppid":0,"name":"onePackage.exe","command_line":"","sha256":"c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6","normalized_path":"C:\\onePackage.exe","uid":"00000000-00007096","icon":"$4c"},{"pid":7580,"ppid":7096,"name":"BitLockerToGo.exe","command_line":"","sha256":"9e02d69b9832cb6da710aa33febdc96e9bea16692bc2db9c330588f882bd5397","normalized_path":"%WINDIR%\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe","parent_uid":"00000000-00007096","uid":"00000000-00007580"},{"pid":4172,"ppid":7096,"name":"memtest.exe","command_line":"","sha256":"d3f17593f988f2e1052b315eb47a025b40ebc293c344885b3c339c703b9366b7","normalized_path":"%WINDIR%\\Boot\\PCAT\\memtest.exe","parent_uid":"00000000-00007096","uid":"00000000-00004172"},{"pid":6596,"ppid":7096,"name":"Microsoft.Msn.Money.exe","command_line":"","sha256":"4846336e3cd1467e55c0441d4c7a89aeff1d8754a0eec7f1796755dbcd209e83","normalized_path":"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe","parent_uid":"00000000-00007096","uid":"00000000-00006596"},{"pid":7260,"ppid":7096,"name":"Microsoft.Msn.News.exe","command_line":"","sha256":"06c65f6c0e4ee94cb790411d73e0296da8d13e8faf9419b52599eb08f1412bd5","normalized_path":"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe","parent_uid":"00000000-00007096","uid":"00000000-00007260"},{"pid":6708,"ppid":7096,"name":"Microsoft.Msn.Sports.exe","command_line":"","sha256":"81f30e510be9ef9103d2e40d8758cc133d45007046ac89b920d17ffa48cee03c","normalized_path":"%WINDIR%\\InfusedApps\\Packages\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe","parent_uid":"00000000-00007096","uid":"00000000-00006708"},{"pid":696,"ppid":7096,"name":"AcroRd32.exe","command_line":"","sha256":"1c52b50019786ce77c3338f470a9193f90f71080196198357744cb065b7c6851","normalized_path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA7DA73301B744BA0000000010\\11.0.0\\AcroRd32.exe","parent_uid":"00000000-00007096","uid":"00000000-00000696"},{"pid":812,"ppid":7096,"name":"AcroRd32Info.exe","command_line":"","sha256":"908c6c1cd5e658ca3788068a1c420b65b186c51e7bca13a903a19c032df3b893","normalized_path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA7DA73301B744BA0000000010\\11.0.0\\AcroRd32Info.exe","parent_uid":"00000000-00007096","uid":"00000000-00000812"}],"all_imported_dlls":["oleaut32.dll","usp10.dll","kernel32.dll","sechost.dll","lpk.dll","ole32.dll","api-ms-win-crt-stdio-l1-1-0.dll","imm32.dll","msvcp140.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","KernelBase.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","bcrypt.dll","user32.dll","vcruntime140.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","ntdll.dll","advapi32.dll","msvcrt.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","msctf.dll","winmm.dll","bcryptprimitives.dll","fltLib.dll","VxSSL32.dll","gdi32.dll","shlwapi.dll","api-ms-win-crt-convert-l1-1-0.dll","ws2_32.dll","nsi.dll","api-ms-win-core-file-l1-2-0.dll","rpcrt4.dll","ucrtbase.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","powrprof.dll","win32u.dll","msvcp_win.dll","sspicli.dll","combase.dll","cryptbase.dll","wow64cpu.dll","apphelp.dll","winmmbase.dll","wow64win.dll","cfgmgr32.dll","wow64.dll","gdi32full.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6aa0255ed8a7f4c3300a229c","66ea6dd70c8ff88d1406a007"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c2588125970d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c2588125970d…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c2588125970d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c2588125970d…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c2588125970d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c2588125970d…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]