26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample c4e7f8b515bb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c4e7f8b515bb…. Malware family: Fragtor.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 14 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.FileRepMalware.30157.21540","applicationCategory":["peexe","executable"],"identifier":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":16,"total":24},"behavioralIndicators":{"malicious":14,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T3928,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360050a1167644d317006d82e77594921f0004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006f006d002e00460069006c0065005200650070004d0061006c0077006100720065002e00330030003100350037002e00320031003500340030002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bc2772782d277d8ebe475ac011b0000001b0000000000000000001b00750003000000000000000000000000000000000000001c007000030000000000000000000000186e1b0000000000200000000000000000000000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775acfe200004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775540b210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005400000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700540b210058d16b76000000005c000000d0cc17004cd4377600000000540b210048000000cccc170004000000e8a820007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775ec13210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005800000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700ec13210058d16b76000000005e000000d0cc17004cd4377600000000ec1321004c000000cccc17000400000048a920007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775841c210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005800000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700841c210058d16b760000000025000000d0cc17004cd4377600000000841c21004c000000cccc170004000000a8a920007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775ec13210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005a00000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700ec13210058d16b76000000001b000000d0cc17004cd4377600000000ec1321004e000000cccc170004000000606620007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775c44a210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005200000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700c44a210058d16b760000000030000000d0cc17004cd4377600000000c44a210046000000cccc17000400000028a820007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e7755c53210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005a00000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc17005c53210058d16b760000000001000000d0cc17004cd43776000000005c5321004e000000cccc170004000000584c21007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775145b210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005a00000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700145b210058d16b76000000002d000000d0cc17004cd4377600000000145b21004e000000cccc170004000000e84b21007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e775446b210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000018cc1700f8921e0024e81700bd06dc750af7c503feffffffda76da75f7a63976400000005200000058d16b76d0d4377654d16b7600000000d0cc170078d337760100010000000880d0d43776fdd33776f0cc1700446b210058d16b76000000004f000000d0cc17004cd4377600000000446b210046000000cccc17000400000008aa20007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360074bf167620cd17006d82e7752478210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000170000000000bad617000500000081d0397670d6170074d617000000000000d120009c50c177e26bda75a8010000a801000040d61700b0ea4177a801000060d617001cdb17005ecb3776a801000000000000005d357678dd17000e5d357610d91700dcaa3976010000000000000072000000ffffffffffffffff98d6170078020000000000002500000098d617007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600a4a41676f0d617006d82e775c483210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2500650027000000620b377600000000186e1b000000000050000000748a21000200000030971d00000000000100000888b3200040721b00380b377624d5170002000000d8d517003f0842770200000030971d00000000000100001888fb4177c8d51700c81c39769ed7170095fb4177fcd6170030971d0000000000000000000000000084d6170000001b007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360050a4167644d617006d82e775c483210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000e77501000000008000000000000000000000a4ce17002333e775d8ce17000080000000800000d8ce17003733e77500000000dece1700d0bc1676c0ce17006732e775b8d31700a8bc1676e4d01700135f3576d8ce1700cad317000100000020d8170058762100ecd51700205f357643003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360048bd16765ccf17006d82e7754c8d210004010000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ec65c177f51dc0777800000000000000000000004083ca774483ca77010000000000000000000000000000000000000000000000ff2bc277b7e0d2772ce01700cc011b0000001b00000000000000000001000000000000000000000000e0fd7f7800000030df1700d91cc07700000000000000000100000090df17000000000064000000e0df1700feffffff68df1700cf00c377d600c377bfe0d2776400000032000000e0df1700e82d1b003cdf170095e1be77 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000683d2200000000000b34003f340000c0903f2200c4001b00702e1f00003b000000001b0000000000683d22008ce117000464c27738011b00e063c2775bded2770000000000001b00703d22006dd14177196108766caea8770000000000000000d8be7d774f34007bc4001b000100000000001b0050011b000c000000703d22000000000002000000180000002c00000068e117000000000000000000030000002ce117003c6ec277000000000000000000000000c8511d00c0754977c8511d0000000000c075497748e1170079da41770000000002000000a0e11700ff2bc277 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002200508522004b852200000000000000000000001b0000000001c4d117000000000028df170095e1be77ff2d0700feffffff435cc2775059c277aa000000b80000004a852200488522004cd3170084d71700000000000000000000000000000000000000000000000000c011000000001b001c5cc17760d8da75ffffffff17000000fcd217002400000003000000ecd7170018dd170084d717008600000028d3170096edc27772852200a06a9875860000004cd3170084d717000000000086008800a06a98754cd31700916c987572852200a06a9875a06a9875bcd7170002020000 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003400)28:T620,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe47538981f0000f0fd7f9a5cc37700e0fd7fb0be170044f0fd7f00000000400000003f0000001c00000000f0fd7fa4be1700c15cc3776082ca771c00000000f0fd7f9a5cc37700e0fd7fc8be17005789c2778083ca771317db75d8ebe475 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "XRJNZC.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002392) "XRJNZC.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe475b81d1c0000a0fd7f9a5cc37700f0fd7fd8b5160044a0fd7f00000000400000003f0000002400000000a0fd7fccb51600c15cc3776082ca772400000000a0fd7f9a5cc37700f0fd7ff0b516005789c2778083ca771317db75d8ebe475 (UID: 00000000-00002392)29:T543,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "timeout.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "XRJNZC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "XRJNZC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2a:T1b62,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter %TEMP%\s1z8.0.bat (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002564) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002392) "XRJNZC.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002392) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001980) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001980) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001980) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001980) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001980) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001980) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001980)2b:T6bf0,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlEnterCriticalSection (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlLeaveCriticalSection (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlDeleteCriticalSection (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlInitializeSListHead (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlDecodePointer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlSizeHeap (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlEncodePointer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RtlReAllocateHeap (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002564) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003400) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003400) "timeout.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002636) "timeout.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002636) "XRJNZC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlEnterCriticalSection (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlLeaveCriticalSection (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlDeleteCriticalSection (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlInitializeSListHead (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlDecodePointer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlSizeHeap (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlEncodePointer (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RtlReAllocateHeap (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002392) "XRJNZC.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002392) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001980) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001980)2c:T36a8,Found reference to API (Indicator: "GetStringTypeW"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "GetCPInfo"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "GetLocaleInfoA"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "GetThreadLocale"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "GetModuleFileNameA"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "InterlockedIncrement"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "VirtualQuery"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "FindResourceExA"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "GetFileType"; File: "SecuriteInfo.com.FileRepMalware.30157.21540") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002564.00000000.66429.002E1000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00002564.00000000.66429.002E1000.00000020.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00002392.00000000.67019.00490000.00000004.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002392.00000000.67019.00490000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002392.00000000.67019.00490000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002392.00000001.68943.0083A000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002564.00000000.66429.0030A000.00000040.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00002564.00000000.66429.023B0000.00000004.mdmp, 00000000-00002564.00000001.66488.023B0000.00000004.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002564.00000000.66429.023B0000.00000004.mdmp, 00000000-00002564.00000001.66488.023B0000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002564.00000000.66429.023B0000.00000004.mdmp, 00000000-00002564.00000001.66488.023B0000.00000004.mdmp")2d:T56c,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.FileRepMalware.30157.21540.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "SecuriteInfo.com.FileRepMalware.30157.21540.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.FileRepMalware.30157.21540.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "SecuriteInfo.com.FileRepMalware.30157.21540.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "XRJNZC.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "XRJNZC.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "XRJNZC.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "XRJNZC.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]2e:T1c5d,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "USER32.DLL" at base 77560000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "ADVAPI32.DLL" at base 75ec0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "NTDLL.DLL" at base 77bd0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "SHELL32.DLL" at base 762f0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "SHLWAPI.DLL" at base 75e60000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "KERNEL32.DLL" at base 773d0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 716c0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "KERNEL32" at base 773d0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75da0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "OLE32.DLL" at base 77920000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "CRYPTBASE.DLL" at base 759d0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74850000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "PROPSYS.DLL" at base 74890000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "COMCTL32.DLL" at base 74a00000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "OLEAUT32.DLL" at base 77330000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "CLBCATQ.DLL" at base 77270000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74890000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "NTMARTA.DLL" at base 74590000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76010000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "PROFAPI.DLL" at base 75af0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "APPHELP.DLL" at base 75980000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f620000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 762f0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 773d0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "SETUPAPI.DLL" at base 76030000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "RPCRT4.DLL" at base 774b0000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75d70000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77a80000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "SECUR32.DLL" at base 75810000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75b00000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71700000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75980000 "SecuriteInfo.com.FileRepMalware.30157.21540.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "cmd.exe" loaded module "KERNEL32.DLL" at base 773d0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75980000 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 716c0000 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "XRJNZC.exe" loaded module "KERNEL32" at base 773d0000 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "XRJNZC.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6bd80000 "XRJNZC.exe" loaded module "USER32.DLL" at base 77560000 "XRJNZC.exe" loaded module "ADVAPI32.DLL" at base 75ec0000 "XRJNZC.exe" loaded module "NTDLL.DLL" at base 77bd0000 "XRJNZC.exe" loaded module "SHELL32.DLL" at base 762f0000 "XRJNZC.exe" loaded module "SHLWAPI.DLL" at base 75e60000 "XRJNZC.exe" loaded module "KERNEL32.DLL" at base 773d0000 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75da0000 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "XRJNZC.exe" loaded module "OLE32.DLL" at base 77920000 "XRJNZC.exe" loaded module "CRYPTBASE.DLL" at base 759d0000 "XRJNZC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74850000 "XRJNZC.exe" loaded module "PROPSYS.DLL" at base 74890000 "XRJNZC.exe" loaded module "COMCTL32.DLL" at base 74a00000 "XRJNZC.exe" loaded module "OLEAUT32.DLL" at base 77330000 "XRJNZC.exe" loaded module "APPHELP.DLL" at base 75980000 "XRJNZC.exe" loaded module "CLBCATQ.DLL" at base 77270000 "XRJNZC.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a7e0000 "XRJNZC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 773d0000 "XRJNZC.exe" loaded module "SETUPAPI.DLL" at base 76030000 "XRJNZC.exe" loaded module "RPCRT4.DLL" at base 774b0000 "XRJNZC.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74890000 "XRJNZC.exe" loaded module "NTMARTA.DLL" at base 74590000 "XRJNZC.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76010000 "XRJNZC.exe" loaded module "PROFAPI.DLL" at base 75af0000 "XRJNZC.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75d70000 "XRJNZC.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77a80000 "XRJNZC.exe" loaded module "SECUR32.DLL" at base 75810000 "XRJNZC.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75b00000 "XRJNZC.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75980000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 716c0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 773d0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74850000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 774b0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76010000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75ec0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 77270000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73fa0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75960000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 743a00002f:Tf25,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "XRJNZC.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "XRJNZC.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "XRJNZC.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "XRJNZC.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "XRJNZC.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "XRJNZC.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "XRJNZC.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "XRJNZC.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "XRJNZC.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "XRJNZC.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "XRJNZC.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "XRJNZC.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "XRJNZC.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "XRJNZC.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "XRJNZC.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "XRJNZC.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "XRJNZC.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "XRJNZC.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "XRJNZC.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "XRJNZC.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "XRJNZC.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")30:T41f,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "timeout.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "timeout.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "XRJNZC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "XRJNZC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")31:T601,Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\s1z8.0.bat" "" (UID: 00000000-00003400) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002636) Spawned process "XRJNZC.exe" (UID: 00000000-00002392) Spawned process "schtasks.exe" with commandline "/create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr %ALLUSERSP ..." (UID: 00000000-00001980) Spawned process "XRJNZC.exe" (UID: 00000000-00003064) Spawned process "XRJNZC.exe" (UID: 00000000-00001472) Spawned process "XRJNZC.exe" (UID: 00000000-00002932) Spawned process "XRJNZC.exe" (UID: 00000000-00003396) Spawned process "XRJNZC.exe" (UID: 00000000-00003916) Spawned process "XRJNZC.exe" (UID: 00000000-00002620) Spawned process "XRJNZC.exe" (UID: 00000000-00002828) Spawned process "XRJNZC.exe" (UID: 00000000-00002492) Spawned process "XRJNZC.exe" (UID: 00000000-00002412) Spawned process "XRJNZC.exe" (UID: 00000000-00003052) Spawned process "XRJNZC.exe" (UID: 00000000-00003996) Spawned process "XRJNZC.exe" (UID: 00000000-00003888) Spawned process "XRJNZC.exe" (UID: 00000000-00000340) Spawned process "XRJNZC.exe" (UID: 00000000-00001972) Spawned process "XRJNZC.exe" (UID: 00000000-00002880) Spawned process "XRJNZC.exe" (UID: 00000000-00003212) Spawned process "XRJNZC.exe" (UID: 00000000-00001432) Spawned process "XRJNZC.exe" (UID: 00000000-00001548) Spawned process "XRJNZC.exe" (UID: 00000000-00003236) Spawned process "XRJNZC.exe" (UID: 00000000-00000892) Spawned process "XRJNZC.exe" (UID: 00000000-00001236)32:T601,Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\s1z8.0.bat" "" (UID: 00000000-00003400) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002636) Spawned process "XRJNZC.exe" (UID: 00000000-00002392) Spawned process "schtasks.exe" with commandline "/create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr %ALLUSERSP ..." (UID: 00000000-00001980) Spawned process "XRJNZC.exe" (UID: 00000000-00003064) Spawned process "XRJNZC.exe" (UID: 00000000-00001472) Spawned process "XRJNZC.exe" (UID: 00000000-00002932) Spawned process "XRJNZC.exe" (UID: 00000000-00003396) Spawned process "XRJNZC.exe" (UID: 00000000-00003916) Spawned process "XRJNZC.exe" (UID: 00000000-00002620) Spawned process "XRJNZC.exe" (UID: 00000000-00002828) Spawned process "XRJNZC.exe" (UID: 00000000-00002492) Spawned process "XRJNZC.exe" (UID: 00000000-00002412) Spawned process "XRJNZC.exe" (UID: 00000000-00003052) Spawned process "XRJNZC.exe" (UID: 00000000-00003996) Spawned process "XRJNZC.exe" (UID: 00000000-00003888) Spawned process "XRJNZC.exe" (UID: 00000000-00000340) Spawned process "XRJNZC.exe" (UID: 00000000-00001972) Spawned process "XRJNZC.exe" (UID: 00000000-00002880) Spawned process "XRJNZC.exe" (UID: 00000000-00003212) Spawned process "XRJNZC.exe" (UID: 00000000-00001432) Spawned process "XRJNZC.exe" (UID: 00000000-00001548) Spawned process "XRJNZC.exe" (UID: 00000000-00003236) Spawned process "XRJNZC.exe" (UID: 00000000-00000892) Spawned process "XRJNZC.exe" (UID: 00000000-00001236)33:T914,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "")34:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")35:Tf73,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "")36:T66c,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\FLTLIB.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to touch file "C:\CRYPTBASE.dll"37:T864,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\PROPSYS.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\ntmarta.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\apphelp.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\version.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Secur32.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\SSPICLI.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL"38:T6d7,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\SecuriteInfo.com.FileRepMalware.30157.21540.exe.Local\" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\s1z8.0.bat:Zone.Identifier" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S1Z8.0" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S1Z8.1" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S1Z8.2" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\SECURITEINFO.COM.FILEREPMALWARE.30157.21540.EXE.LOCAL" "SecuriteInfo.com.FileRepMalware.30157.21540.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\s1z8.0.bat:ZONE.IDENTIFIER" "cmd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S1Z8.1" "cmd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S1Z8.2" "XRJNZC.exe" trying to access non-existent file "C:\ProgramData\pinterests\XRJNZC.exe.Local\" "XRJNZC.exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:Zone.Identifier" "XRJNZC.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\pinterests\XRJNZC.EXE.LOCAL" "XRJNZC.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\schtasks.exe:ZONE.IDENTIFIER"39:Td06,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindFirstFileW" with parameter %TEMP%\*.* (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter 10D5CC3F-71C4-40D7-8173-E990C25C1412.Diagnose.Admin.0.etl (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter 99F9947D-30DB-4640-92C7-6BB2A24B05F1.Diagnose.Admin.0.etl (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter AA7D7BE8-CE8F-4570-A39C-1992F0466AAE.Diagnose.Admin.0.etl (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter AdobeARM.log (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter AdobeARM_NotLocked.log (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter AdobeSFX.log (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter Adobe_ADMLogs (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter ASPNETSetup_00001.log (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter ASPNETSetup_00002.log (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter ccversion.tag (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter chromesetup.msi (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter CVR640E.tmp.cvr (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter CVR78E9.tmp.cvr (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter CVRC166.tmp.cvr (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter CVRE8FB.tmp.cvr (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat17FA.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat17FB.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat2336.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat4FD7.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat4FF7.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat5008.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat558A.tmp (UID: 00000000-00002564) "SecuriteInfo.com.FileRepMalware.30157.21540.exe" called "FindNextFileW" with parameter dat558B.tmp (UID: 00000000-00002564)3a:Tc04,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\pinterests\XRJNZC.exe" (Indicator: "\Device\"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp") Found string "\Device\HarddiskVolume2\SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Indicator: "\Device\"; Source: "00000000-00002564.00000000.66429.001B0000.00000004.mdmp, 00000000-00002564.00000001.66488.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002564.00000001.66488.001B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002564.00000001.66488.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002564.00000001.66488.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002564.00000001.66488.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002564.00000001.66488.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002564.00000001.66488.001B0000.00000004.mdmp")3b:T4a4,"SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "XRJNZC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "XRJNZC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "XRJNZC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "XRJNZC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "")3c:Tf7d,33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2392) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3064) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 1472) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2932) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3396) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3916) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2620) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2828) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2492) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2412) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3052) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3996) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3888) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 340) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 1972) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2880) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3212) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 1432) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 1548) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3236) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 892) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 1236) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 1924) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 4036) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 3796) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2060) as malicious (classified as "ClipBanker.R622458" with 45% detection rate) 33/72 Antivirus vendors marked spawned process "XRJNZC.exe" (PID: 2800) as malicious (classified as "ClipBanker.R622458" with 45% detection rate)3d:T78e,Spawned process "SecuriteInfo.com.FileRepMalware.30157.21540.exe" (UID: 00000000-00002564) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\s1z8.0.bat" "" (UID: 00000000-00003400) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002636) Spawned process "XRJNZC.exe" (UID: 00000000-00002392) Spawned process "schtasks.exe" with commandline "/create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe /f" (UID: 00000000-00001980) Spawned process "XRJNZC.exe" (UID: 00000000-00003064) Spawned process "XRJNZC.exe" (UID: 00000000-00001472) Spawned process "XRJNZC.exe" (UID: 00000000-00002932) Spawned process "XRJNZC.exe" (UID: 00000000-00003396) Spawned process "XRJNZC.exe" (UID: 00000000-00003916) Spawned process "XRJNZC.exe" (UID: 00000000-00002620) Spawned process "XRJNZC.exe" (UID: 00000000-00002828) Spawned process "XRJNZC.exe" (UID: 00000000-00002492) Spawned process "XRJNZC.exe" (UID: 00000000-00002412) Spawned process "XRJNZC.exe" (UID: 00000000-00003052) Spawned process "XRJNZC.exe" (UID: 00000000-00003996) Spawned process "XRJNZC.exe" (UID: 00000000-00003888) Spawned process "XRJNZC.exe" (UID: 00000000-00000340) Spawned process "XRJNZC.exe" (UID: 00000000-00001972) Spawned process "XRJNZC.exe" (UID: 00000000-00002880) Spawned process "XRJNZC.exe" (UID: 00000000-00003212) Spawned process "XRJNZC.exe" (UID: 00000000-00001432) Spawned process "XRJNZC.exe" (UID: 00000000-00001548) Spawned process "XRJNZC.exe" (UID: 00000000-00003236) Spawned process "XRJNZC.exe" (UID: 00000000-00000892) Spawned process "XRJNZC.exe" (UID: 00000000-00001236) Spawned process "XRJNZC.exe" (UID: 00000000-00001924) Spawned process "XRJNZC.exe" (UID: 00000000-00004036) Spawned process "XRJNZC.exe" (UID: 00000000-00003796) Spawned process "XRJNZC.exe" (UID: 00000000-00002060) Spawned process "XRJNZC.exe" (UID: 00000000-00002800)3e:T4d9,Assembly shows XOR instruction xor si word ptr [edi+esi-669FFFFEh] in Stream UID: 35177-1712-00C832D0 Assembly shows XOR instruction xor al byte ptr [edi+esi] in Stream UID: 35177-1712-00C832D0 Assembly shows XOR instruction xor ebx dword ptr [ebp+514E2CA0h] in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor esp dword ptr [edi+33h] in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor esp dword ptr [esi] in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor esi dword ptr [edi] in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor eax dword ptr [ebx] in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor dword ptr [ebp+4Dh] esi in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor dword ptr [EE3CCF7Ah+edi*8] edi in Stream UID: 35177-18398-00F20C23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35177-29801-010E8FAE Assembly shows XOR instruction xor dword ptr [ecx] esp in Stream UID: 35177-29801-010E8FAE Assembly shows XOR instruction xor esp dword ptr [esi+449B27DBh] in Stream UID: 35177-29801-010E8FAE Assembly shows XOR instruction xor esp 3B234C45h in Stream UID: 35177-29801-010E8FAE3f:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp")40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==44:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==48:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==49:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==4d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==50:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==51:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==54:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZmZmZmACJ3d3d3dwAAAABmZmZmZgAid3d3d3cAAAAAZmbuZmZmiHd3iIh3dwAAAGZm7mZmZoh3d4iId3cAAABmZu5mZneIiIiIiIiIAAAAZmbuZmZ3iIiIiIiIiAAAAHd3d3dmiIiIiIiIiIgAAAB3d3d3ZoiIiIiIiIiIAAAAiHeIiGaI/4iIiIiIiAAAAIh3iIhmiP+IiIiIiIgAAACIiIiId4j//////4iIAAAAiIiIiHeI//////+IiAAAAIiIiIh3d4j//////4gAAACIiIiId3eI//////+IAAAAiIiIiIh3d3d3d2aIAAAAAIiIiIiId3d3d3dmiAAAAACIiP//iIiId2ZmZgAAAAAAiIj//4iIiHdmZmYAAAAAAIiI//+IiIh3d2aIAAAAAACIiP//iIiId3dmiAAAAAAAAIiIiIh3dwAAAAAAAAAAAACIiIiId3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////////////////////wAAD/8AAA//AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAD/8AAA//AAA//wAAP/8AAD//AAA//wAA//8AAP//wD///8A/////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790357728698,"unified_at":"2026-09-25T17:35:28.698Z","metadata":{"hashes":{"sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","sha1":"960c00c0247a8002fb2c750915239d058d28c6a6","md5":"e6feb2feedcd40debe9652807abe05a2","sha512":"eb908d5a9e8608bb1b48acdffcb176d94adc2d29d550637755c2ae025f5c7943520dacfc95995772e9fd1e7c4267dc18b863c4a0221208fb06d77f8f68f8229a","ssdeep":"98304:usqGmmq+Dh8rbJF4N1IMlj8S5gNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJ/:ubW8YvIMxx5gNvpbXZ778hsIvY6j1J","ssdeep_chunks":["98304:usqGmmq","98304:sqGmmq+","98304:qGmmq+D","98304:Gmmq+Dh","98304:mmq+Dh8","98304:mq+Dh8r","98304:q+Dh8rb","98304:+Dh8rbJ","98304:Dh8rbJF","98304:h8rbJF4","98304:8rbJF4N","98304:rbJF4N1","98304:bJF4N1I","98304:JF4N1IM","98304:F4N1IMl","98304:4N1IMlj","98304:N1IMlj8","98304:1IMlj8S","98304:IMlj8S5","98304:Mlj8S5g","98304:lj8S5gN","98304:j8S5gNg","98304:8S5gNgq","98304:S5gNgqV","98304:5gNgqVp","98304:gNgqVpb","98304:NgqVpbT","98304:gqVpbTY","98304:qVpbTYV","98304:VpbTYVg","98304:pbTYVgZ","98304:bTYVgZo","98304:TYVgZoj","98304:YVgZoj4","98304:VgZoj47","98304:gZoj47M","98304:Zoj47MZ","98304:oj47MZ5","98304:j47MZ5F","98304:47MZ5FV","98304:7MZ5FV0","98304:MZ5FV0Z","98304:Z5FV0ZI","98304:5FV0ZIv","98304:FV0ZIvY","98304:V0ZIvY4","98304:0ZIvY4m","98304:ZIvY4mQ","98304:IvY4mQj","98304:vY4mQj1","98304:Y4mQj1z","98304:4mQj1zv","98304:mQj1zvJ","98304:Qj1zvJ/","196608:usqGmmq","196608:sqGmmq+","196608:qGmmq+D","196608:Gmmq+Dh","196608:mmq+Dh8","196608:mq+Dh8r","196608:q+Dh8rb","196608:+Dh8rbJ","196608:Dh8rbJF","196608:h8rbJF4","196608:8rbJF4N","196608:rbJF4N1","196608:bJF4N1I","196608:JF4N1IM","196608:F4N1IMl","196608:4N1IMlj","196608:N1IMlj8","196608:1IMlj8S","196608:IMlj8S5","196608:Mlj8S5g","196608:lj8S5gN","196608:j8S5gNg","196608:8S5gNgq","196608:S5gNgqV","196608:5gNgqVp","196608:gNgqVpb","196608:NgqVpbT","196608:gqVpbTY","196608:qVpbTYV","196608:VpbTYVg","196608:pbTYVgZ","196608:bTYVgZo","196608:TYVgZoj","196608:YVgZoj4","196608:VgZoj47","196608:gZoj47M","196608:Zoj47MZ","196608:oj47MZ5","196608:j47MZ5F","196608:47MZ5FV","196608:7MZ5FV0","196608:MZ5FV0Z","196608:Z5FV0ZI","196608:5FV0ZIv","196608:FV0ZIvY","196608:V0ZIvY4","196608:0ZIvY4m","196608:ZIvY4mQ","196608:IvY4mQj","196608:vY4mQj1","196608:Y4mQj1z","196608:4mQj1zv","196608:mQj1zvJ","196608:Qj1zvJ/","98304:ubW8YvI","98304:bW8YvIM","98304:W8YvIMx","98304:8YvIMxx","98304:YvIMxx5","98304:vIMxx5g","98304:IMxx5gN","98304:Mxx5gNv","98304:xx5gNvp","98304:x5gNvpb","98304:5gNvpbX","98304:gNvpbXZ","98304:NvpbXZ7","98304:vpbXZ77","98304:pbXZ778","98304:bXZ778h","98304:XZ778hs","98304:Z778hsI","98304:778hsIv","98304:78hsIvY","98304:8hsIvY6","98304:hsIvY6j","98304:sIvY6j1","98304:IvY6j1J"],"imphash":"edac19bae7a55f5a30336032d0b4ae67"},"file_info":{"file_name":"SecuriteInfo.com.FileRepMalware.30157.21540","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5498368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1700738058000,"last_seen":1746278442000,"last_multi_scan":1746278442000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","arwobot","banker","delf","gaertob","generik","injector","irc","ircbot","evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":122,"suspicious_count":15,"malicious_count":14,"total":151},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.ClipBanker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare[Packed]/Win32.VMProtect.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Nekark.kdwzj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.450921","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Acll","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.450921 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/ClipBanker.SH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059f2081 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ClipBanker.BM.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UDS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"SScope.TrojanDropper.Hider","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.VMProtect.Win32.88869","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Fragtor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"Queries COM task scheduler class object"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"XRJNZC.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"\" is zero\n Raw size of \".imports\" is zero\n Raw size of \".Insert0\" is zero\n Raw size of \".themida\" is zero\n Raw size of \".boot\" is zero\n Raw size of \".Insert1\" is zero\n Raw size of \".Winzip0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.990038169742966","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002564)\n \"XRJNZC.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"IsWow64Process\" with parameter \"2564\" - (UID: 00000000-00002564)\n \"XRJNZC.exe\" called \"IsWow64Process\" with parameter \"2392\" - (UID: 00000000-00002392)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"1980\" - (UID: 00000000-00001980)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00002564)\n \"XRJNZC.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002564)\n \"XRJNZC.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001980)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"SecuriteInfo.com.FileRepMalware.30157.21540\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$29","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"108,,GetWindowTextA,user32.dll,\"252:02:55.883\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"XRJNZC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\S1Z8.0.BAT\")\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\S1Z8.0.BAT\")\n \"XRJNZC.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"XRJNZC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"XRJNZC.exe\" called \"CopyFileA\" to copy %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe to new location %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\pinterests (UID: 00000000-00002564)\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00002564)\n \"XRJNZC.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\s1z8.0.bat\"\" - (UID: 00000000-00002564)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout 3\" - (UID: 00000000-00003400)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe\"\" - (UID: 00000000-00003400)\n \"XRJNZC.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /sc MINUTE /mo 1 /RL HIGHEST /tn \"XRJNZC\" /tr %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe /f\" - (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"12746685268,3272,3137,,CreateProcessW,kernel32.dll,\"252:03:18.972\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: SecuriteInfo.com.FileRepMalware.30157.21540)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: XRJNZC.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"4689258707,3188,3162,,ShellExecuteA,Shell32.dll,\"252:03:04.875\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002392.00000000.67019.00170000.00000004.mdmp, 00000000-00002392.00000001.68943.00170000.00000004.mdmp, 00000000-00002392.00000002.70865.00170000.00000004.mdmp\")\n Found reference to API \"12753129526,3272,3162,,ShellExecuteA,Shell32.dll,\"252:03:18.972\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"indows\\system32\\cmd.exe /c\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")\n Found string \"indows\\system32\\cmd.exe /c \"\"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\s1z8.0.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")\n Found string \"indows\\system32\\cmd.exe /c \"\"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\s1z8.0.bat\" \"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")\n Found string \"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\User\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")\n Found string \"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\User\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002564.00000001.66488.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; File: \"SecuriteInfo.com.FileRepMalware.30157.21540\")\n Found reference to API \"LdrFindResource_U\" (Indicator: \"FindResource\"; Source: \"00000000-00002392.00000000.67019.00490000.00000004.mdmp\")\n Found reference to API \"LdrFindResource_U\" (Indicator: \"FindResource\"; Source: \"00000000-00002564.00000000.66429.023B0000.00000004.mdmp, 00000000-00002564.00000001.66488.023B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 2132262)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00002564-00000574-1457922\")\n Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00002564-00000574-1500373\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00002564-00000574-1500609\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002392.00000000.67019.00170000.00000004.mdmp\n 00000000-00002392.00000001.68943.00170000.00000004.mdmp\n 00000000-00002392.00000002.70865.00170000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002392.00000000.67019.00170000.00000004.mdmp\n 00000000-00002392.00000001.68943.00170000.00000004.mdmp\n 00000000-00002392.00000002.70865.00170000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00002392.00000001.68943.0083A000.00000040.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00002564.00000000.66429.0030A000.00000040.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002564.00000001.66488.001B0000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002564.00000001.66488.001B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\XRJNZC\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"XRJNZC\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\s1z8.0.bat\" \"\" (UID: 00000000-00003400)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"XRJNZC.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 774B0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 774B0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 774B0000\n \"XRJNZC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 774B0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 774B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003ccad66b@ADVAPI32.dll\"\n \"0e000f00eccad66b@ADVAPI32.dll\"\n \"0e000f0048cbd66b@ADVAPI32.dll\"\n \"1100120024d3d66b@ADVAPI32.dll\"\n \"11001200c0d3d66b@ADVAPI32.dll\"\n \"1200130004d4d66b@ADVAPI32.dll\"\n \"120013005cd4d66b@ADVAPI32.dll\"\n \"14001500ecf3d66b@ADVAPI32.dll\"\n \"1400150004f4d66b@ADVAPI32.dll\"\n \"140015001cf4d66b@ADVAPI32.dll\"\n \"1700180034f4d66b@ADVAPI32.dll\"\n \"0d000e004cf4d66b@ADVAPI32.dll\"\n \"0d000e00acd4d66b@SHELL32.dll\"\n \"0d000e0028d5d66b@SHELL32.dll\"\n \"0f00100078f5d66b@ADVAPI32.dll\"\n \"14001500b8f5d66b@ADVAPI32.dll\"\n \"14001500d0f5d66b@ADVAPI32.dll\"\n \"0c000d0018f6d66b@ADVAPI32.dll\"\n \"0c000d0028f6d66b@ADVAPI32.dll\"\n \"0e000f0038f6d66b@ADVAPI32.dll\"\n \"18001900a0f7d66b@RPCRT4.dll\"\n \"13001400ccf7d66b@RPCRT4.dll\"\n \"14001500e0f7d66b@RPCRT4.dll\"\n \"16001700f8f7d66b@RPCRT4.dll\"\n \"0b000c005cf0d66b@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" was detected as \"Themida/Winlicense\" and name: \"Protector\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" was detected as \"VMProtect\" and name: \"Protector\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"XRJNZC.exe\" was detected as \"Themida/Winlicense\" and name: \"Protector\"\n \"XRJNZC.exe\" was detected as \"VMProtect\" and name: \"Protector\"\n \"XRJNZC.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" has an executable section named \"\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an executable section named \".themida\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an executable section named \".boot\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an executable section named \".Insert1\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an executable section named \".Winzip0\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an executable section named \".Winzip2\"\n \"XRJNZC.exe\" has an executable section named \"\"\n \"XRJNZC.exe\" has an executable section named \".themida\"\n \"XRJNZC.exe\" has an executable section named \".boot\"\n \"XRJNZC.exe\" has an executable section named \".Insert1\"\n \"XRJNZC.exe\" has an executable section named \".Winzip0\"\n \"XRJNZC.exe\" has an executable section named \".Winzip2\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" has an writable section named \"\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an writable section named \".imports\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an writable section named \".themida\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540\" has an writable section named \".Winzip1\"\n \"XRJNZC.exe\" has an writable section named \"\"\n \"XRJNZC.exe\" has an writable section named \".imports\"\n \"XRJNZC.exe\" has an writable section named \".themida\"\n \"XRJNZC.exe\" has an writable section named \".Winzip1\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" file has an entrypoint instructions - \"pushfd\t,call\t0xec9304,mov\teax, dword ptr [esi],mov\tecx, 0x6b1da220,sal\tcl, 0x67,mov\tcx, word ptr [esi + ecx - 0x6b1da1fc],push\t0x8c8e69a7,call\t0xed2fc2,sub\tesi, 1,movzx\teax, byte ptr [esi],xor\tal, bl,call\t0xe84a28,lea\tesp, [esp + 0xc],jmp\t0xca31f7,mov\tedi, dword ptr [ebp],mov\teax, dword ptr [ebp + 4],mov\tecx, 0xddb42c95,mov\tcl, byte ptr [ebp + 8],add\tebp, 6,push\t0xfcbe0c27,rol\tbyte ptr [esp], 0x64,shld\tedi, eax, cl,mov\tdword ptr [ebp], edi,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".Winzip2\" is \"0x53aa00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".themida\" is \"0x3e8000\" greater than 0x100000\n Virtual size of \".boot\" is \"0x26a600\" greater than 0x100000\n Virtual size of \".Winzip0\" is \"0x1eafbf\" greater than 0x100000\n Virtual size of \".Winzip2\" is \"0x53a960\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00003400-00000C41-265756154]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00002392-00000C41-4666629881]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /create /sc MINUTE /mo 1 /RL HIGHEST /tn \"XRJNZC\" /tr %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe /f\" [Source: 00000000-00002392-00000C41-4666629881]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"timeout.exe\" (UID: 00000000-00002636) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"XRJNZC.exe\" (UID: 00000000-00003064) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$30","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002564-00000C25-41631986]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"\"%TEMP%\\\\s1z8.0.bat\" \"\" on 2023-11-23.11:17:02.435","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"RegmonClass\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"18467-41\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"FilemonClass\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"Regmonclass\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" searching for class \"Filemonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$32","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1446602)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"XRJNZC.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" connecting to \"\\ThemeApiPort\"\n \"XRJNZC.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"XRJNZC.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"schtasks.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"XRJNZC.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe]- [targetUID: 00000000-00002392]\n \"s1z8.0.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"- Location: [%TEMP%\\s1z8.0.bat]- [targetUID: 00000000-00002564]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries COM task scheduler class object","description":"$34","origin":"Registry Access","mitre_attack_id":"T1053","relevance":3,"id":"registry-141","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" reads file \"c:\\securiteinfo.com.filerepmalware.30157.21540.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"cmd.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"XRJNZC.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"XRJNZC.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" writes file \"c:\\programdata\\pinterests\\xrjnzc.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"{W.Bb\"\n Heuristic match: \"S`F.Uz\"\n Heuristic match: \"MO.EU\"\n Heuristic match: \"_).cz\"\n Heuristic match: \"*~.RW\"\n Heuristic match: \"T~.dm\"\n Heuristic match: \"W}yf.Ly\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Heuristic match: \"_r.vn\"\n Heuristic match: \"U2.Km\"\n Heuristic match: \"~ .mU\"\n Heuristic match: \"J@<.hk\"\n Heuristic match: \"la.pW\"\n Heuristic match: \"df.Sg\"\n Heuristic match: \"{xw.rE\"\n Heuristic match: \"KK.MK\"\n Heuristic match: \"vj.sk\"\n Heuristic match: \"VI,!h.Tn\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"XRJNZC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}\n \"XRJNZC.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AES)\" (Indicator: \"aes\"; Source: \"00000000-00002392.00000001.68943.00ED6000.00000020.mdmp\")\n Found string \"AES)\" (Indicator: \"aes\"; Source: \"00000000-00002564.00000001.66488.009A6000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"SecuriteInfo.com.FileRepMalware.30157.21540\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: SecuriteInfo.com.FileRepMalware.30157.21540]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: XRJNZC.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"XRJNZC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"DEL \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\s1z8.2\" /f /q\" (Indicator: \"del \") in Source: s1z8.0.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00002564.00000000.66429.002E1000.00000020.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002392.00000001.68943.0083A000.00000040.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002564.00000000.66429.0030A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" opened \"\\Device\\KsecDD\"\n \"XRJNZC.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".Winzip2\n .Winzip2 with unusual entropies 7.99124519204\n 7.99198140928","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe\" has high entropy 7.991595190531362","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")\n \"XRJNZC.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"XRJNZC.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"XRJNZC.exe\" (Thread ID: 3136) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/72 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"XRJNZC.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"XRJNZC.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe]- [targetUID: 00000000-00002392]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" wrote 4096 bytes starting with PE header signature to file \"C:\\ProgramData\\pinterests\\XRJNZC.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\s1z8.0.bat\" \"\" (UID: 00000000-00003400)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"XRJNZC.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"XRJNZC.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"XRJNZC.exe\" claimed CRC 5498425 while the actual is CRC 5260283","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540\" has an entrypoint in section \".Winzip2\"\n \"XRJNZC.exe\" has an entrypoint in section \".Winzip2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ShellExecuteExW\n UnhandledExceptionFilter\n FindResourceExA\n FindResourceExW\n IsDebuggerPresent\n GetModuleFileNameA\n GetModuleHandleA\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetCommandLineA\n GetStartupInfoA\n WriteProcessMemory\n GetProcAddress\n CreateFileW\n CreateFileA\n GetSystemInfo\n GetModuleHandleW\n WriteFile\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" at 00000000-00002564-00000105-1519022\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" at 00000000-00002564-00000105-1519121\n \"XRJNZC.exe\" at 00000000-00002392-00000105-1471504\n \"XRJNZC.exe\" at 00000000-00002392-00000105-1471595","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")\n \"XRJNZC.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"XRJNZC.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/72 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\s1z8.0.bat (UID: 00000000-00002564)\n \"XRJNZC.exe\" called \"ShellExecuteA\" with parameter schtasks.exe (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"SecuriteInfo.com.FileRepMalware.30157.21540.exe\" allocated memory in \"C:\\SecuriteInfo.com.FileRepMalware.30157.21540.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"XRJNZC.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 572)\n \"XRJNZC.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 572)\n \"XRJNZC.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 572)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00001424.00000000.192967.00B8A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005692-00000C2A-1954322718\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\SystemRoot\\System32\\drivers\\vmci.\" (Indicator: \"\\vmci\"; Source: \"00000000-00006940.00000000.195366.052C0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\System32\\drivers\\vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00006940.00000000.195366.052C0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00006940.00000000.195366.052C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\System32\\drivers\\vmci.\" (Indicator: \"\\vmci\"; Source: \"00000000-00006940.00000000.195366.052C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B00000.00000004.mdmp, 00000000-00005768.00000002.192575.03B00000.00000004.mdmp\")\n Found reference to API \"11772681864,6216,100,,FindWindowExW,user32.dll,\"00:49:08.953\",RX=0,PX=0\" (Indicator: \"findwindow\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp\")\n Found reference to API \"79066644734,6216,100,,FindWindowExW,user32.dll,\"00:49:36.984\",RX=0,PX=0\" (Indicator: \"findwindow\"; Source: \"00000000-00005768.00000001.190657.03B3C000.00000004.mdmp, 00000000-00005768.00000002.192575.03B3C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"11772681864,6216,100,,FindWindowExW,user32.dll,\"00:49:08.953\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp\")\n Found reference to API \"79066644734,6216,100,,FindWindowExW,user32.dll,\"00:49:36.984\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005768.00000001.190657.03B3C000.00000004.mdmp, 00000000-00005768.00000002.192575.03B3C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00005812-00000C16-1959732063","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00005812-00000C16-1959732063","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005768.00000000.188736.03B00000.00000004.mdmp\n 00000000-00005768.00000001.190657.03B3C000.00000004.mdmp\n 00000000-00005768.00000002.192575.03B3C000.00000004.mdmp\n 00000000-00005768.00000002.192575.06690000.00000002.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005768.00000000.188736.03B00000.00000004.mdmp\n 00000000-00005768.00000001.190657.03B3C000.00000004.mdmp\n 00000000-00005768.00000002.192575.03B3C000.00000004.mdmp\n 00000000-00005768.00000002.192575.06690000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77780000\n \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BD0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77780000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77780000\n \"XRJNZC.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77780000\n \"XRJNZC.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BD0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77780000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\" queries basic process information of the \"C:\\c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\" (UID: 5692)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE00CD6AC3E8DB21E6DF4E2946DA8C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp, 00000000-00005768.00000001.190657.03B3C000.00000004.mdmp, 00000000-00005768.00000002.192575.03B3C000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE776DB93BE8411AC56B2045771514]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE776DB93BE8411AC56B2045771514]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005768.00000000.188736.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\" has section name .Winzip2 with entropy \"7.991245192044602\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\s4e4.0.bat\"\" - (UID: 00000000-00005692)\n \"XRJNZC.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /sc MINUTE /mo 1 /RL HIGHEST /tn \"XRJNZC\" /tr %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe /f\" - (UID: 00000000-00005768)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73D10000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /sc MINUTE /mo 1 /RL HIGHEST /tn \"XRJNZC\" /tr %ALLUSERSPROFILE%\\\\pinterests\\\\XRJNZC.exe /f\" (UID: 00000000-00006584)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}]},"activity":{"stats":{"process_count":31,"spawned_processes_count":31,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","arwobot","banker","delf","gaertob","generik","injector","irc","ircbot","evasive"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"68161829b5ba25d8be035a86","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64.exe","analysis_start_time":"2025-05-03T13:20:43+00:00","indicators_count":{"informative":108,"suspicious":36,"malicious":10},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"655f340954ed22e8ff0bb346","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ClipBanker.R622458","submit_name":"SecuriteInfo.com.FileRepMalware.30157.21540","analysis_start_time":"2023-11-23T11:14:18+00:00","indicators_count":{"informative":91,"suspicious":36,"malicious":12},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}],"processes":[{"pid":2564,"ppid":0,"name":"SecuriteInfo.com.FileRepMalware.30157.21540.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"C:\\SecuriteInfo.com.FileRepMalware.30157.21540.exe","uid":"00000000-00002564","icon":"$40"},{"pid":3400,"ppid":2564,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\s1z8.0.bat\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002564","uid":"00000000-00003400"},{"pid":2636,"ppid":3400,"name":"timeout.exe","command_line":"timeout 3","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00003400","uid":"00000000-00002636"},{"pid":2392,"ppid":3400,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","parent_uid":"00000000-00003400","uid":"00000000-00002392"},{"pid":1980,"ppid":2392,"name":"schtasks.exe","command_line":"/create /sc MINUTE /mo 1 /RL HIGHEST /tn \"XRJNZC\" /tr %ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00002392","uid":"00000000-00001980"},{"pid":3064,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003064","icon":"$41"},{"pid":1472,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00001472","icon":"$42"},{"pid":2932,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002932","icon":"$43"},{"pid":3396,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003396","icon":"$44"},{"pid":3916,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003916","icon":"$45"},{"pid":2620,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002620","icon":"$46"},{"pid":2828,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002828","icon":"$47"},{"pid":2492,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002492","icon":"$48"},{"pid":2412,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002412","icon":"$49"},{"pid":3052,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003052","icon":"$4a"},{"pid":3996,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003996","icon":"$4b"},{"pid":3888,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003888","icon":"$4c"},{"pid":340,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00000340","icon":"$4d"},{"pid":1972,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00001972","icon":"$4e"},{"pid":2880,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002880","icon":"$4f"},{"pid":3212,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003212","icon":"$50"},{"pid":1432,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00001432","icon":"$51"},{"pid":1548,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00001548","icon":"$52"},{"pid":3236,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003236","icon":"$53"},{"pid":892,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00000892","icon":"$54"},{"pid":1236,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00001236","icon":"$55"},{"pid":1924,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00001924","icon":"$56"},{"pid":4036,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00004036","icon":"$57"},{"pid":3796,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00003796","icon":"$58"},{"pid":2060,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002060","icon":"$59"},{"pid":2800,"ppid":0,"name":"XRJNZC.exe","command_line":"","sha256":"c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64","normalized_path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","uid":"00000000-00002800","icon":"$5a"}],"all_imported_dlls":["kernel32.dll","shdocvw.dll","urlmon.dll","xmllite.dll","imm32.dll","uxtheme.dll","propsys.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","ktmw32.dll","taskschd.dll","advapi32.dll","profapi.dll","sechost.dll","ws2_32.dll","Wldap32.dll","devobj.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","fltLib.dll","cfgmgr32.dll","sspicli.dll","ieframe.dll","oleaut32.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","ntdll.dll","msvcrt.dll","winbrand.dll","ole32.dll","api-ms-win-core-synch-l1-2-0.dll","userenv.dll","KernelBase.dll","shell32.dll","ntmarta.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wininet.dll","usp10.dll","shlwapi.dll","nsi.dll","clbcatq.dll","apphelp.dll","setupapi.dll","version.dll","gdi32.dll","comctl32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","user32.dll","lpk.dll","rpcrt4.dll","msctf.dll","VxSSL32.dll","cryptbase.dll","api-ms-win-downlevel-version-l1-1-0.dll","Windows.StateRepositoryPS.dll","ucrtbase.dll","windows.storage.dll","wow64.dll","gdi32full.dll","edputil.dll","msvcp_win.dll","powrprof.dll","cryptsp.dll","imagehlp.dll","SHCore.dll","bcryptprimitives.dll","kernel.appcore.dll","cldapi.dll","msIso.dll","OneCoreUAPCommonProxyStub.dll","wow64cpu.dll","cmdext.dll","win32u.dll","combase.dll","bcrypt.dll","wow64win.dll","aepic.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"XRJNZC.exe","sha256":"98101949a3de7a3ae4f0fc0488e406890de0fca8d5b514b77dd4a555d3d1247d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"s1z8.0.bat","sha256":"781d36ae8d3d4201f4726c49294664091a5ec20c290086fb66bb09c595a7c53d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"name":"s4e4.0.bat","sha256":"888bf06bc870a517140f4e655c984dbe813be7ac8a7b234cf218c03a8eb7ad8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"path":"%ALLUSERSPROFILE%\\pinterests\\XRJNZC.exe","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"path":"%TEMP%\\s4e4.0.bat","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\XRJNZC","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"XRJNZC","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"655f340954ed22e8ff0bb346"},{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Local\\SM0:5692:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Local\\SM0:5692:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"SM0:5692:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Local\\SM0:5768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"Local\\SM0:5768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]},{"name":"SM0:5768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68161829b5ba25d8be035a86"}]}]}},"report_ids":{"sandbox_job_ids":["68161829b5ba25d8be035a86","655f340954ed22e8ff0bb346"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Fragtor.Generic Sample c4e7f8b515bb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c4e7f8b515bb…. Malware family: Fragtor.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 14 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64"}],["$","meta","4",{"property":"og:title","content":"Malicious Fragtor.Generic Sample c4e7f8b515bb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c4e7f8b515bb…. Malware family: Fragtor.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 14 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Fragtor.Generic Sample c4e7f8b515bb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c4e7f8b515bb…. Malware family: Fragtor.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 14 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]