26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c54eb244078d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c54eb244078d…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 16 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71"],"about":{"@type":"SoftwareApplication","name":"Bypasss.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":30},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T41f7,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetNumberFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "AttachConsole"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "OemToCharBuffA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "FoldStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CopyRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOpenFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "AllocConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSaveFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")28:Tc2c,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '9764864', 'hResInfo': '10147216'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '9764864', 'hResInfo': '10146912'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '9764864', 'hResInfo': '10146816'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '9764864', 'hResInfo': '10147040'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1990066176', 'hResInfo': '5768688'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1749352448', 'hResInfo': '1749780552'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1749352448', 'hResInfo': '1749780088'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1749352448', 'hResInfo': '1749780568'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1749352448', 'hResInfo': '1749780120'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '9764864', 'hResInfo': '10146896'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1947402240', 'hResInfo': '1948777632'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1945239552', 'hResInfo': '1945403736'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1945239552', 'hResInfo': '28967752'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '99221505', 'hResInfo': '99348256'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '99221505', 'hResInfo': '99323408'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '99221505', 'hResInfo': '99323440'}" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadResource with parameter {'hModule': '1947402240', 'hResInfo': '29362008'}" (UID: 00000000-00001892)29:T13c0,file/memory contains long string with (Indicator: "Aes"; File: "4.EXE") file/memory contains long string with (Indicator: "AesGcm"; File: "4.EXE") file/memory contains long string with (Indicator: "AesManaged"; File: "4.EXE") file/memory contains long string with (Indicator: "HMAC"; File: "4.EXE") file/memory contains long string with (Indicator: "HMACSHA1"; File: "4.EXE") file/memory contains long string with (Indicator: "HMACSHA256"; File: "4.EXE") file/memory contains long string with (Indicator: "SHA1Managed"; File: "4.EXE") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00004368.00000000.81531.01372000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00004368.00000000.81531.01372000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesManaged" (Indicator: "Aes"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesManaged" (Indicator: "AesManaged"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesManaged" (Indicator: "Aes"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesManaged" (Indicator: "AesManaged"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00000976.00000001.83461.003F2000.00000020.mdmp")2a:Tcf8,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP")2b:T13e9,Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-249-0042C803 Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-249-0042C803 Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-392-004282C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-392-004282C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-1286-0041CABE Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-1286-0041CABE Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-1362-00427E0E Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-1362-00427E0E Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-1416-004279A7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-1416-004279A7 Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-1421-0042784E Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-1421-0042784E Assembly shows XOR instruction xor eax ebp in Stream UID: 9344-1422-004278A4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 9344-1422-004278A4 Assembly shows XOR instruction xor eax 01h in Stream UID: 9344-1597-00407070 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-13-0097E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-13-0097E003 Assembly shows XOR instruction xor ecx 49656E69h in Stream UID: 00000000-00001892-10696-21-0096D8B6 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00001892-10696-21-0096D8B6 Assembly shows XOR instruction xor eax 756E6547h in Stream UID: 00000000-00001892-10696-21-0096D8B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-40-0097794E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-40-0097794E Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00001892-10696-42-00977735 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00001892-10696-42-00977735 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-50-009778F8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-50-009778F8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-59-00975B53 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-59-00975B53 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-120-00974ADF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-120-00974ADF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-170-009793F3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-170-009793F3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-177-009773AE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-177-009773AE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-178-00977A09 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-178-00977A09 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00001892-10696-207-0097E8D4 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00001892-10696-207-0097E8D4 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00001892-10696-207-0097E8D4 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00001892-10696-207-0097E8D4 Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00001892-10696-289-0095DF34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-688-0096CABE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-688-0096CABE Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00001892-10696-699-00971C79 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00001892-10696-699-00971C79 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00001892-10696-738-0096DC18 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00001892-10696-738-0096DC18 Assembly shows XOR instruction xor ecx dword ptr [ebp-14h] in Stream UID: 00000000-00001892-10696-738-0096DC18 Assembly shows XOR instruction xor ecx dword ptr [ebp-04h] in Stream UID: 00000000-00001892-10696-738-0096DC18 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001892-10696-738-0096DC18 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-796-00977E0E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-796-00977E0E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001892-10696-815-00978618 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001892-10696-815-009786182c:T545,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to decrypt/decode data Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms2d:T2940,Found XOR loop in file "123.exe" at offset 120452; code bytes = 30040e Found XOR loop in file "123.exe" at offset 1774592; code bytes = 30040e Found XOR loop in file "123.exe" at offset 2384487; code bytes = 30040e Found XOR loop in file "svhost.exe" at offset 363060; code bytes = 30d0 Found XOR loop in file "svhost.exe" at offset 71811; code bytes = 33c1 Found XOR loop in file "svhost.exe" at offset 71864; code bytes = 33c1 Found XOR loop in file "svhost.exe" at offset 131091; code bytes = 33c1 Found XOR loop in file "svhost.exe" at offset 149706; code bytes = 33c1 Found XOR loop in file "svhost.exe" at offset 188474; code bytes = 33c1 Found XOR loop in file "svhost.exe" at offset 341468; code bytes = 33c1 Found XOR loop in file "svhost.exe" at offset 24009; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 108629; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 120223; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 122526; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 127477; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 128538; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 219927; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 341380; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 538010; code bytes = 8030 Found XOR loop in file "svhost.exe" at offset 542085; code bytes = 8030 Found XOR loop in file "4.EXE" at offset 34592; code bytes = 8030 Found XOR loop in file "4.EXE" at offset 395990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 241889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 295931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 299183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 454231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 477651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 477996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 484758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 518881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 547811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 679713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 796066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 814828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 890727; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 996889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1049671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1084445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1326300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1332229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1371731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1551267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1671826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1676916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2121231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2144605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2232779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2252426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2389322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2539677; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2634936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2674820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2689216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2833749; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2860496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 13568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 52133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 121222; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 121353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 296375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 387609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 403910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 421734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 483084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 506327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 509357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 650824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 654091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 775354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 954448; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 964800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1019467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1030713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1042212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1052293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1240569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1241715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1261484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1271479; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1337565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1475647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1625605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1843925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1931080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1954193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2019233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2033079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2044299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2205632; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2438868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2457732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2494578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2629169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2653631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2742413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2834090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2925166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 48238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 299144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 300830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 301228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 329578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 335328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 510835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 522962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 573034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 580913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 705096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 710210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 764271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 873678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 924927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1029562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1039306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1039919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1113609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1114968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1117321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1172354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1175097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1506493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1545692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1597766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1598441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1633915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1716031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1926155; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1968594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2077604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2139552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2304279; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2356398; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2401699; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2527231; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2563081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2599970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2823135; code bytes = 80302e:T668,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "210430043c043e044004300441043f0430043a043e0432044b04320430044e0449043804390441044f042000300440044504380432042000570069006e00520041005200" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "26001f0430043f043a04300420003d04300437043d043004470435043d0438044f04" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "26001e04310437043e0440042e002e002e00" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "25043e043404200043044104420430043d043e0432043a043804" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "23044104420430043d043e043204380442044c04" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "1e0442043c0435043d043004" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "%USERPROFILE%\AppData\Roaming" - (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00001892)2f:T386e,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000014f12f0098f72f00d8f82f0092e0426845c01440feffffffccf72f004c9c4268630c0000e0f72f005f9c426800000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000be7600000000000000000000b976000000005caac77300000000ecf72f00ecf72f0050b2d97397b2d973a8001928000000001cf92f0001000000010000001cf92f00bcf72f0018f82f00d8f82f00eed4cf7334aeea5bfeffffff97b2d9732bb3d973000000000010000000000100fffffe7f03000000080000004a020000000001000600004f940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47dd73502645008c47dd73000000005026450098f82f00086d387718814077000000001cf92f00000000008cf82f00 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000180000000000000000f02f000000000048fa2f0092e0426845c01440feffffffb8f62f004c9c42680d0c0000d8f62f005f9c42680000000000000000000000000000000000000000000000001dc278280cf72f00ee2d41680d0c0000d8f62f0064a8c77364a8c773fe2d416840f72f00010000000000000000007973000000002cf72f0000000000000000000000000040f72f00000000000000000000000000a9c3782834f72f00186d2c7534f72f002a6d2c75000000000000000000007973842edc0100000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e8003f6e00000000f4c02e0008c22e0054c42e0095e13477af8d6b00ff2b38778b547d7744e1426eac01400000004000000000000000000019007f003a0c000002000000b08e8c01109a3900480089011a007a003a0c00003c00000001000000287140000000000020000000000000000000000070ed4300186e4000386f4000401e4500e072400034c22e0030c12e00b08e8c01b0c22e0095e134772f896b00feffffffff2b38779a2a387744e1426e34e1426e000000006974650073746572000000009cc22e00c88e8c012cc22e0080f4e776000039000000000089f4e776 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600611a7f28a8ce2b006d824e7794c14c0004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000320003000000000000000200000018c74c00f85d4f00186e40003200020001000000f40100000a0000000000000000000000005e4f00c201000009000000e0724000050000000000000032000000f8ce4c00c8b92b00cc41397718c74c0028000000fc000000ff2b3877f72c7877d8eb6176ac014000000040002e001600010000000000ffff1308000004000000010000002f001100010000000100000001000000000000000000000028714000f8070000200000000000000000000000f85d4f00186e4000386f4000a8c74c00e07240000000000044b92b0000000000c4ba2b00 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b005a005c00a4c72b00c8c92b0084c82b0553002d0031002d0035002d00320031002d0032003000390032003300350036003000340033002d0034003000340031003700300030003800310037002d003600360033003100320037003200300034002d0031003000300031000000eccc2b009e0062011700000048c64c000000400010c74c0018000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e773493470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000ff620000f4c72b0067e5357700004000509847000000000000004000000000005098470000000000ab6200c980000000f89a4700683efb02d0ba4600003b0000000040000000000050984700802900000000400048954700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e7734b3470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000ff5e0000f4c72b0067e535770000400050b8470000000000000040000000000050b8470000000000ab5e00f580000000f8ba4700683efb02100ef202003b0000000040000000000050b84700802900000000400048b54700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e7734b4470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000df5e0000f4c72b0067e535770000400050b9470000000000000040000000000050b94700000000008b5e00d580000000f8bb4700683efb02100ef202003b0000000040000000000050b94700802900000000400048b64700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e77d4b5470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000ab5e0000f4c72b0067e5357700004000f0ba4700000000000000400000000000f0ba470000000000575e00098000000098bd4700683efb02b8bb4600003b00000000400000000000f0ba47008029000000004000e8b74700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e7704b7470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000855e0000f4c72b0067e535770000400020bc470000000000000040000000000020bc470000000000315e006f80000000c8be4700683efb02b8bb4600003b0000000040000000000020bc4700802900000000400018b94700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e772cb8470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000605e0000f4c72b0067e535770000400048bd470000000000000040000000000048bd4700000000000c5e005280000000f0bf4700683efb02b8bb4600003b0000000040000000000048bd4700802900000000400040ba4700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e775cb9470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f83040003a5e0000f4c72b0067e535770000400078be470000000000000040000000000078be470000000000e65d00bb8000000020c14700683efb02b8bb4600003b0000000040000000000078be4700802900000000400070bb4700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e778cba470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000145e0000f4c72b0067e5357700004000a8bf4700000000000000400000000000a8bf470000000000c05d009d8000000050c24700683efb02b8bb4600003b00000000400000000000a8bf47008029000000004000a0bc4700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e77b4bb470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004700f83b0000ff07000000004000683efb027f070000683efb02f8304000ef5d0000f4c72b0067e5357700004000d0c04700000000000000400000000000d0c04700000000009b5d00c68000000078c34700683efb02b8bb4600003b00000000400000000000d0c047008029000000004000c8bd4700f83b0000ff07000000004000683efb027f070000683efb027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d1c7f2884c82b006d824e77ecbc470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000d9e57c28a4d12b00a4d12b001e75406800000000f8724700dcd82b00a802000000000000000000000000000080d62b005ecba175a802000000000000005d9f75dcd82b000e5d9f7574d42b00dcaaa375010000000000000072000000fffffffffffffffffcd12b00780200000000000025000000fcd12b007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600dd067f2854d22b006d824e7734c7470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff10004c010f010000620ba175000000002871400000000000500000007cc947000200000008fb430000000000010000080882450050754000380ba17588d02b00020000003cd12b003f08be760200000008fb4300000000000100001888fbbd762cd12b00c81ca37502d32b0095fbbd7660d22b0008fb4300000000000000000000000000e8d12b00000040007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360061057f28a8d12b006d824e7734c7470004010000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600491e7f28c0ca2b006d824e7774cb470004010000 (UID: 00000000-00001892)30:Tfa8,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47dd73502645008c47dd73000000005026450098f82f00086d387718814077000000001cf92f00000000008cf82f00d8f82f0095e13477ff846b00feffffff6b2c397731192d75021000000000000000000100acf82f00c89f38778c47dd730000000000000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6176a8c74c0000a0fd7f9a5c397700f0fd7f88ba2b0044a0fd7f00000000400000003f0000002200000000a0fd7f7cba2b00c15c3977608240772200000000a0fd7f9a5c397700f0fd7fa0ba2b00578938778083407713172d75d8eb6176 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efeff273566a6c280200000044c7f27300003000aecaf2735c958c0128958c0130e22b0000000000f0e22b0044d6f373c267b55bfeffffffefeff2736deff273aecaf27384e22b0090e8f273aecaf27367c1e7762875f473a0e22b00c2c6f2732875f47300000000d0e32b0000000000 (UID: 00000000-00001892) "svhost.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000064007700500072006f006300650073007300490064002c0030002c0030002c002c0031003100310030000d000a0000006c00330032002e0064006c006c002c0022003200350032003a00300036003a00340033002e0038003600330022002c00520058003d0030002c00500058003d00 (UID: 00000000-00004368) "4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006300720069007000740073005c003b0043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c00500072006f006700720061006d0073005c0050007900740068006f006e005c005000 (UID: 00000000-00000976) "4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f5f63877853c4b77f42eb071e0416b00a035b071553c4b77c8e81800d01a6b00b2f43877a53c4b77d8e818000000a9710000a9710000000034e81800f0000000f000a9710000000044e8180053000000d8e918000000000001000000a8e8180040f53877000000000000000094e81800 (UID: 00000000-00000976) "4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47dd73b029b6038c47dd7300000000b029b603c4e01800086d3877188140770000000078e1180000000000de54c46404e1180095e13477e5c56b00feffffff6b2c397731192d75021000000000000000000100d8e01800c89f38778c47dd730000000000000000 (UID: 00000000-00000976) "4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000976)31:T4fa,"svhost.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\svhost.exe" at 00000000-00004368-0000010C-3353363 "4.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\4.EXE" at 00000000-00000976-0000010C-4223201 "4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000976-0000010C-12110305 "4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000976-0000010C-12118077 "4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00000976-0000010C-13879037 "4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00000976-0000010C-14046140 "4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000976-0000010C-1484096832:T3f30,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DUser.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00001892) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004368) "svhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004368) "4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000976) "4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00000976)33:Tfb70,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter LoadBitmapW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DialogBoxParamW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SendDlgItemMessageW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetDlgItemTextW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetDlgItemTextW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter LoadIconWithScaleDown (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetGadgetParent (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetDUserModule (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter FindStdColor (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetGadgetRect (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetBufferedPaintDC (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter GetBufferedPaintTargetDC (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DisableContainerHwnd (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DUserFlushMessages (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DUserFlushDeferredMessages (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DeleteHandle (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter UnregisterMessagePumpHook (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DetachWndProc (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00001892) "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001892) "svhost.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004368) "svhost.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004368) "4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenEventLog (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter OpenEventLogW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CloseEventLog (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetNumberOfEventLogRecords (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetNumberOfEventLogRecordsW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetOldestEventLogRecord (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetOldestEventLogRecordW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ReadEventLog (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ReadEventLogW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00000976) "4.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000976)34:Tbef,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "svhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]35:T4c3,"Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00000976.00000001.83461.00610000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00000976.00000002.85385.00610000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00001892.00000000.80480.002AD000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00001892.00000001.81286.002AB000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001892.00000001.81286.00400000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001892.00000001.81286.004AB000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001892.00000001.81286.00980000.00000002.mdmp "Software\WinRAR SFX" in Source: 00000000-00001892.00000001.81286.00980000.00000002.mdmp36:T2b93,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "CRYPTBASE.DLL" at base 75130000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e70000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "COMCTL32.DLL" at base 74130000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73c60000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "SHELL32.DLL" at base 75990000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "OLE32.DLL" at base 76640000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "USER32.DLL" at base 769e0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "WINDOWSCODECS.DLL" at base 73790000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "GDI32.DLL" at base 76fb0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "DWMAPI.DLL" at base 73a90000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "UXTHEME.DLL" at base 73e70000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "COMCTL32" at base 74130000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "IMM32.DLL" at base 77490000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "ADVAPI32.DLL" at base 77000000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "SHLWAPI.DLL" at base 774d0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "CLBCATQ.DLL" at base 76f20000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75990000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 6e3f0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "RPCRT4.DLL" at base 76c70000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76640000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75610000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "PROPSYS.DLL" at base 73f60000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "OLEAUT32.DLL" at base 76af0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73f60000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "NTMARTA.DLL" at base 746a0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77560000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "PROFAPI.DLL" at base 75240000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "APPHELP.DLL" at base 750e0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6fdb0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 752b0000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76d20000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "SECUR32.DLL" at base 74f60000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "SETUPAPI.DLL" at base 77190000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75290000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70c30000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "NTDLL.DLL" at base 77330000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "DUSER.DLL" at base 73f20000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73f20000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 73a60000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "KERNEL32.DLL" at base 76b90000 "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750e0000 "svhost.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 682b0000 "svhost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "svhost.exe" loaded module "KERNEL32" at base 76b90000 "svhost.exe" loaded module "ADVAPI32.DLL" at base 77000000 "svhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b8a0000 "svhost.exe" loaded module "SHLWAPI.DLL" at base 774d0000 "svhost.exe" loaded module "VERSION.DLL" at base 746d0000 "svhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64b50000 "svhost.exe" loaded module "USER32.DLL" at base 769e0000 "svhost.exe" loaded module "MSCOREE.DLL" at base 6b930000 "svhost.exe" loaded module "PSAPI.DLL" at base 77480000 "svhost.exe" loaded module "RPCRT4.DLL" at base 76c70000 "svhost.exe" loaded module "KERNEL32.DLL" at base 76b90000 "svhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63740000 "svhost.exe" loaded module "OLE32.DLL" at base 76640000 "svhost.exe" loaded module "CRYPTBASE.DLL" at base 75130000 "svhost.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72fd0000 "svhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69f20000 "4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70bc0000 "4.exe" loaded module "KERNEL32" at base 76b90000 "4.exe" loaded module "ADVAPI32.DLL" at base 77000000 "4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b8a0000 "4.exe" loaded module "SHLWAPI.DLL" at base 774d0000 "4.exe" loaded module "VERSION.DLL" at base 746d0000 "4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64b50000 "4.exe" loaded module "USER32.DLL" at base 769e0000 "4.exe" loaded module "MSCOREE.DLL" at base 6b930000 "4.exe" loaded module "PSAPI.DLL" at base 77480000 "4.exe" loaded module "RPCRT4.DLL" at base 76c70000 "4.exe" loaded module "KERNEL32.DLL" at base 76b90000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63740000 "4.exe" loaded module "OLE32.DLL" at base 76640000 "4.exe" loaded module "CRYPTBASE.DLL" at base 75130000 "4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e70000 "4.exe" loaded module "CRYPTSP.DLL" at base 74c40000 "4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 749d0000 "4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72fd0000 "4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69f20000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ce0000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 62b30000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61cc0000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 614a0000 "4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72370000 "4.exe" loaded module "SHELL32.DLL" at base 75990000 "4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77560000 "4.exe" loaded module "PROFAPI.DLL" at base 75240000 "4.exe" loaded module "BCRYPT.DLL" at base 74d50000 "4.exe" loaded module "ADVAPI32" at base 77000000 "4.exe" loaded module "UXTHEME.DLL" at base 73e70000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 68470000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60d20000 "4.exe" loaded module "NTDLL.DLL" at base 77330000 "4.exe" loaded module "IMM32.DLL" at base 77490000 "4.exe" loaded module "COMCTL32.DLL" at base 71a90000 "4.exe" loaded module "GDI32.DLL" at base 76fb0000 "4.exe" loaded module "GDIPLUS.DLL" at base 73c60000 "4.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73c60000 "4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b90000 "4.exe" loaded module "DWMAPI.DLL" at base 73a90000 "4.exe" loaded module "COMCTL32.DLL" at base 74130000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 60a40000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 60730000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6e510000 "4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 60020000 "4.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b330000 "4.exe" loaded module "WS2_32.DLL" at base 76ab0000 "4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c00000 "4.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74760000 "4.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74bf0000 "4.exe" loaded module "OLEAUT32.DLL" at base 76af0000 "4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6bff000037:T630,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71" was detected as "WinRAR" and name: "sfx" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71" was detected as "Microsoft Visual C/C++" and name: "Compiler" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71" was detected as "Microsoft Linker" and name: "Linker" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71" was detected as "RAR" and name: "Archive" "123.exe" was detected as "WinRAR" and name: "sfx" "123.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "123.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "123.exe" was detected as "Microsoft Linker" and name: "Linker" "123.exe" was detected as "RAR" and name: "Archive" "svhost.exe" was detected as "WinRAR" and name: "sfx" "svhost.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "svhost.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "svhost.exe" was detected as "Microsoft Linker" and name: "Linker" "svhost.exe" was detected as "RAR" and name: "Archive" "4.EXE" was detected as "WinRAR" and name: "sfx" "4.EXE" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4.EXE" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4.EXE" was detected as "Microsoft Linker" and name: "Linker" "4.EXE" was detected as "RAR" and name: "Archive"38:T82b,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Microsoft AutoComplete" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "4.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")39:Tf45,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001892-00000C2B-261564375] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00001892-00000C2B-261994121] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00001892-00000C2B-264007396] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00001892-00000C2B-264301956] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00001892-00000C2B-264519292] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00001892-00000C2B-267836455] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00001892-00000C2B-268436944] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004368-00000C2B-277831334] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004368-00000C2B-278369495] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004368-00000C2B-279684336] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004368-00000C2B-279877803] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004368-00000C2B-280154674] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004368-00000C2B-280237096] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004368-00000C2B-280466345] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000976-00000C2B-282661504] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00000976-00000C2B-282787803] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00000976-00000C2B-282887358] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000976-00000C2B-283043692] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00000976-00000C2B-283151792] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000976-00000C2B-283813763] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000976-00000C2B-285007594] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00000976-00000C2B-285773932] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00000976-00000C2B-286071793] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00000976-00000C2B-286201461] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000976-00000C2B-287990584]3a:Tb2a,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")3b:T11b5,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "C54EB244078DCAF2472C85BCCE337B152DC24154D6A03004A29E4F4069D49D71"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")3c:Tb51,"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" trying to touch file "C:\c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe.Local\" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe" trying to touch file "C:\Windows\system32\" - Source: "00000000-00006864.00000000.150129.1F102000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjdecddecdglobalsign" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0geotrust" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.1hcgn1addtrust" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006864.00000000.150129.5DC50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007304.00000000.149723.02FB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007304.00000000.149723.05090000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007304.00000000.149723.05090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007304.00000001.151643.02FB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007304.00000002.153564.02FB0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json06/03" - Source: "00000000-00007304.00000002.153564.05000000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,006/03" - Source: "00000000-00007304.00000002.153564.05000000.00000002.mdmp")4f:T5b3,Found string "+ncalrpc:[OLE4159A262799195F19E6B97781971]" (Indicator: "ncalrpc"; Source: "00000000-00006864.00000000.150129.43A20000.00000004.mdmp") Found string "+ncalrpc:[OLEA517E3DE556F958CFBC07B7AF42B]" (Indicator: "ncalrpc"; Source: "00000000-00007304.00000001.151643.1EDF1000.00000004.mdmp, 00000000-00007304.00000002.153564.1EDF1000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00007304.00000001.151643.21F10000.00000004.mdmp, 00000000-00007304.00000002.153564.21F10000.00000004.mdmp") Found string "+ncalrpc:[OLEEF8CC80E36022BB8ACB7CFC24C2E]" (Indicator: "ncalrpc"; Source: "00000000-00007304.00000001.151643.21F10000.00000004.mdmp, 00000000-00007304.00000002.153564.21F10000.00000004.mdmp") Found string "B+ncalrpc:[OLEEF8CC80E36022BB8ACB7CFC24C2E]" (Indicator: "ncalrpc"; Source: "00000000-00007304.00000001.151643.21F10000.00000004.mdmp, 00000000-00007304.00000002.153564.21F10000.00000004.mdmp") Found string "+ncalrpc:[OLE619A05E532A2AD8CA4F550FD3D81]" (Indicator: "ncalrpc"; Source: "00000000-00007972.00000000.149715.02F70000.00000004.mdmp") Found string "+ncalrpc:[OLEEF8CC80E36022BB8ACB7CFC24C2E]" (Indicator: "ncalrpc"; Source: "00000000-00007972.00000000.149715.02F70000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00007972.00000000.149715.02F70000.00000004.mdmp")50:T82b,"Bypasss.exe" called "FindFirstFileW" with parameter C:\Bypasss.exe (UID: 00000000-00002588) "Bypasss.exe" called "FindFirstFileW" with parameter svhost.exe (UID: 00000000-00002588) "Bypasss.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\svhost.exe (UID: 00000000-00002588) "Bypasss.exe" called "FindFirstFileW" with parameter 123.exe (UID: 00000000-00002588) "Bypasss.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\123.exe (UID: 00000000-00002588) "Bypasss.exe" called "FindFirstFileW" with parameter 4.EXE (UID: 00000000-00002588) "Bypasss.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\4.EXE (UID: 00000000-00002588) "svhost.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007972) "svhost.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007972) "svhost.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007972) "svhost.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007972) "svhost.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Client\* (UID: 00000000-00007972)51:T13d7,"4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\URAN\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CGEEODPFAGJCEEFIEFLMDFPHPLKENLFK" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ACMACODKJBDGMOLEEBOLMDJONILKDBCH" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NHNKBKGJIKGCIGADOMKPHALANNDCAPJK" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CNMAMAACHPPNKJGNILDPDMKAAKEJNHAE" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\JOJHFEOEDKPKGLBFIMDFABPDFJAOOLAF" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKNHIEHLKLIPPAFAKAEKLBEGLECIFHAD" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC" "4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\DKDEDLPGDMMKKFJABFFEGANIEAMFKLKM"52:T212b,4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NHNKBKGJIKGCIGADOMKPHALANNDCAPJK related to Clover Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CNMAMAACHPPNKJGNILDPDMKAAKEJNHAE related to Auro Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\JOJHFEOEDKPKGLBFIMDFABPDFJAOOLAF related to Polymesh Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKNHIEHLKLIPPAFAKAEKLBEGLECIFHAD related to Nabox Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC related to Temple 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\DKDEDLPGDMMKKFJABFFEGANIEAMFKLKM related to Cyano Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CIHMOADAIGHCEJOPAMMFBMDDCMDEKCJE related to LeafWallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\LODCCJJBDHFAKAEKDIAHMEDFBIELDGIK related to DAppPlay 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\IJMPGKJFKBFHOEBGOGFLFEBNMEJMFBML related to BitClip 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ONOFPNBBKEHPMMOABGPCPMIGAFMMNJHL related to Nash Extension 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\BCOPGCHHOJMGGMFFILPLMBDICGAIHLKP related to Hycon Lite Client 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\KLNAEJJGBIBMHLEPHNHPMAOFOHGKPGKD related to ZilPay 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\CPHHLGMGAMEODNHKJDMKPANLELNLOHAO related to NeoLine 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\DMKAMCKNOGKGCDFHHBDDCGHACHKEJEAP related to Keplr 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FHMFENDGDOCMCBMFIKDCOGOFPHIMNKNO related to Sollet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FLPICIILEMGHBMFALICAJOOLHKKENFEL related to ICONex 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HCFLPINCPPPDCLINEALMANDIJCMNKBGN related to KHC 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\MNFIFEFKAJGOFKCJKEMIDIAECOCNKJEH related to TezBox 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NLGBHDFGDHGBIAMFDFMBIKCDGHIDOADD related to Byone 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NHNKBKGJIKGCIGADOMKPHALANNDCAPJK related to Clover Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CNMAMAACHPPNKJGNILDPDMKAAKEJNHAE related to Auro Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JOJHFEOEDKPKGLBFIMDFABPDFJAOOLAF related to Polymesh Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKNHIEHLKLIPPAFAKAEKLBEGLECIFHAD related to Nabox Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC related to Temple 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\DKDEDLPGDMMKKFJABFFEGANIEAMFKLKM related to Cyano Wallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CIHMOADAIGHCEJOPAMMFBMDDCMDEKCJE related to LeafWallet 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\LODCCJJBDHFAKAEKDIAHMEDFBIELDGIK related to DAppPlay 4.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IJMPGKJFKBFHOEBGOGFLFEBNMEJMFBML related to BitClip53:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}54:T7d9,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")55:T50c,"Bypasss.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\123.exe" (Handle: 880) "Bypasss.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\123.exe" (Handle: 880) "Bypasss.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\123.exe" (Handle: 880) "Bypasss.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\123.exe" (Handle: 880) "Bypasss.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\svhost.exe" (Handle: 836) "Bypasss.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\svhost.exe" (Handle: 836) "Bypasss.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\svhost.exe" (Handle: 836) "Bypasss.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\svhost.exe" (Handle: 836) "Bypasss.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\4.EXE" (Handle: 836) "Bypasss.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\4.EXE" (Handle: 836) "Bypasss.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\4.EXE" (Handle: 836) "Bypasss.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\4.EXE" (Handle: 836)56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==5c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790609838918,"unified_at":"2026-09-28T15:37:18.918Z","metadata":{"hashes":{"sha256":"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","sha1":"0acb3c5b6a6bd568656c7dc9f2bebaf0ea01207a","md5":"c313d79bb52d3dc1a0fdd298a6c47810","sha512":"c937b08e72578c71d79387dbb625436e7381b784a8a3977a50cc758de8badfc57e8c566db135aa1e6f1ea01b682c4675302ee25c4f74e60238ca2c4714834a08","ssdeep":"49152:VIf2lo986T2njmZHDIkduvYcg9/YyCBGQPDK2z3fANo7+VnAeRq8HBaegPzcxCnG:VIKdiZvdPf2DGQ7L3gR7HBaegPzcxCnG","ssdeep_chunks":["49152:VIf2lo9","49152:If2lo98","49152:f2lo986","49152:2lo986T","49152:lo986T2","49152:o986T2n","49152:986T2nj","49152:86T2njm","49152:6T2njmZ","49152:T2njmZH","49152:2njmZHD","49152:njmZHDI","49152:jmZHDIk","49152:mZHDIkd","49152:ZHDIkdu","49152:HDIkduv","49152:DIkduvY","49152:IkduvYc","49152:kduvYcg","49152:duvYcg9","49152:uvYcg9/","49152:vYcg9/Y","49152:Ycg9/Yy","49152:cg9/YyC","49152:g9/YyCB","49152:9/YyCBG","49152:/YyCBGQ","49152:YyCBGQP","49152:yCBGQPD","49152:CBGQPDK","49152:BGQPDK2","49152:GQPDK2z","49152:QPDK2z3","49152:PDK2z3f","49152:DK2z3fA","49152:K2z3fAN","49152:2z3fANo","49152:z3fANo7","49152:3fANo7+","49152:fANo7+V","49152:ANo7+Vn","49152:No7+VnA","49152:o7+VnAe","49152:7+VnAeR","49152:+VnAeRq","49152:VnAeRq8","49152:nAeRq8H","49152:AeRq8HB","49152:eRq8HBa","49152:Rq8HBae","49152:q8HBaeg","49152:8HBaegP","49152:HBaegPz","49152:BaegPzc","49152:aegPzcx","49152:egPzcxC","49152:gPzcxCn","49152:PzcxCnG","98304:VIf2lo9","98304:If2lo98","98304:f2lo986","98304:2lo986T","98304:lo986T2","98304:o986T2n","98304:986T2nj","98304:86T2njm","98304:6T2njmZ","98304:T2njmZH","98304:2njmZHD","98304:njmZHDI","98304:jmZHDIk","98304:mZHDIkd","98304:ZHDIkdu","98304:HDIkduv","98304:DIkduvY","98304:IkduvYc","98304:kduvYcg","98304:duvYcg9","98304:uvYcg9/","98304:vYcg9/Y","98304:Ycg9/Yy","98304:cg9/YyC","98304:g9/YyCB","98304:9/YyCBG","98304:/YyCBGQ","98304:YyCBGQP","98304:yCBGQPD","98304:CBGQPDK","98304:BGQPDK2","98304:GQPDK2z","98304:QPDK2z3","98304:PDK2z3f","98304:DK2z3fA","98304:K2z3fAN","98304:2z3fANo","98304:z3fANo7","98304:3fANo7+","98304:fANo7+V","98304:ANo7+Vn","98304:No7+VnA","98304:o7+VnAe","98304:7+VnAeR","98304:+VnAeRq","98304:VnAeRq8","98304:nAeRq8H","98304:AeRq8HB","98304:eRq8HBa","98304:Rq8HBae","98304:q8HBaeg","98304:8HBaegP","98304:HBaegPz","98304:BaegPzc","98304:aegPzcx","98304:egPzcxC","98304:gPzcxCn","98304:PzcxCnG","49152:VIKdiZv","49152:IKdiZvd","49152:KdiZvdP","49152:diZvdPf","49152:iZvdPf2","49152:ZvdPf2D","49152:vdPf2DG","49152:dPf2DGQ","49152:Pf2DGQ7","49152:f2DGQ7L","49152:2DGQ7L3","49152:DGQ7L3g","49152:GQ7L3gR","49152:Q7L3gR7","49152:7L3gR7H","49152:L3gR7HB","49152:3gR7HBa","49152:gR7HBae","49152:R7HBaeg","49152:7HBaegP"],"imphash":"00be6e6c4f9e287672c8301b72bdabf3"},"file_info":{"file_name":"Bypasss.exe","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":2947209,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1717410867000,"last_seen":1788895918000,"last_multi_scan":1788895918000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","redlinestealer","informationstealer","backdoor","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":107},"sandbox_signatures":{"informative_count":317,"suspicious_count":30,"malicious_count":16,"total":363},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.72999357","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.DarkKomet-10027799-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.72999357 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Packed.BDF.a.khmh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-8ed38c1a!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.JVU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Read system defined device setup information from registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"malicious","value":"Stops/delete service using SC.exe"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Contains ability to perform AES encryption (Dotnet String)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screenshot"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of a forensics/monitoring tool"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"malicious","value":"Starts service using SC.exe"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on RAR SFX file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with low confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"sample.bin\"), Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\WinRAR SFX\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"\nWaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"\nWaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ywvi.md\", Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Heuristic match: \"to9.uk\", Heuristic match: \"~*.dm\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-920","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-108","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"FindResourceW\" with parameter \"9963048\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"FindResourceW\" with parameter \"4255\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"FindResourceW\" with parameter \"1010\" - (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 9344-1308-0041DD7C\n SetUnhandledExceptionFilter@KERNEL32.dll at 9344-2283-0041DBC3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-10696-59-00975B53\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-10696-712-0096DA75\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-10696-739-0096DD7C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001892-10696-1506-0096DBC3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00004368.00000000.81531.01372000.00000020.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004368.00000000.81531.01372000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000976.00000000.81539.00670000.00000004.mdmp, 00000000-00000976.00000001.83461.00670000.00000004.mdmp, 00000000-00000976.00000002.85385.00670000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001892.00000000.80480.00400000.00000004.mdmp, 00000000-00001892.00000001.81286.00400000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004368.00000000.81531.004E0000.00000004.mdmp, 00000000-00004368.00000002.85379.004E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.96389","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"IndexedDB\\https_www.youtube.com_0.indexeddb.leve\" (Indicator: \"youtube.com\"; Source: \"00000000-00000976-00000CB4-284665482\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000976-00000C2C-286437114\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"\\qemu-ga.exe\" (Indicator: \"qemu-ga.exe\"; Source: \"00000000-00000976-00000CB4-284859783\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000976-00000C2C-286437114\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000976-00000C2C-286469180\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001892.00000001.81286.00980000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001892.00000001.81286.00980000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00000976-00000CB4-284691644\")\n Found string \"moz_cookies\" (Indicator: \"moz_cookies\"; Source: \"00000000-00000976-00000CB4-284694635\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001892.00000001.81286.00980000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001892.00000001.81286.00980000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"IsWow64Process\" with parameter \"1892\" - (UID: 00000000-00001892)\n \"svhost.exe\" called \"IsWow64Process\" with parameter \"4368\" - (UID: 00000000-00004368)\n \"4.exe\" called \"IsWow64Process\" with parameter \"976\" - (UID: 00000000-00000976)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2e","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GetActiveWindow\" (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001892)\n \"4.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000976)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 9344-1746-00419B7B\n GetTickCount@KERNEL32.DLL at 00000000-00001892-10696-1240-00969B7B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 9344-1023-0040A273\n FindFirstFileExA@KERNEL32.dll at 9344-1362-00427E0E\n FindFirstFileW@KERNEL32.dll at 9344-1784-0041A545\n FindNextFileW@KERNEL32.DLL at 00000000-00001892-10696-370-0095A273\n FindFirstFileExA@KERNEL32.DLL at 00000000-00001892-10696-796-00977E0E\n FindFirstFileW@KERNEL32.DLL at 00000000-00001892-10696-1278-0096A545","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Wi\" (Indicator: \"select * from \"; Source: \"00000000-00000976-00000CB4-284351453\")\n Found string \"SELECT * FROM Win32_VideoControl\" (Indicator: \"select * from \"; Source: \"00000000-00000976-00000CB4-284361585\")\n Found string \"SELECT * FROM Win32_Process Wher\" (Indicator: \"select * from \"; Source: \"00000000-00000976-00000CB4-284379335\")\n Found string \"SELECT * FROM Win32_OperatingSys\" (Indicator: \"select * from \"; Source: \"00000000-00000976-00000CB4-284472238\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.dll at 9344-1072-00410050\n FileTimeToLocalFileTime@KERNEL32.dll at 9344-1140-0040FE20\n FileTimeToLocalFileTime@KERNEL32.dll at 9344-1784-0041A545\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00001892-10696-434-00960050\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001892-10696-503-0095FE20\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-10696-738-0096DC18\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001892-10696-1278-0096A545","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 9344-1070-0040FFB8\n GetSystemTime@KERNEL32.DLL at 00000000-00001892-10696-432-0095FFB8\n GetLocalTime@KERNEL32.DLL at 00000000-00001892-10696-657-0096C131\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001892-10696-738-0096DC18","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00001892-10696-411-0095A8E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 9344-1266-0041932F\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00001892-10696-636-0096932F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"svhost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 9344-1277-0041C8D7\n GetSystemInfo@KERNEL32.DLL at 00000000-00001892-10696-679-0096C8D7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00000976.00000000.81539.00670000.00000004.mdmp\n 00000000-00000976.00000001.83461.00670000.00000004.mdmp\n 00000000-00000976.00000002.85385.00670000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 9344-2337-00428AAA\n GetProcessHeap@KERNEL32.DLL at 00000000-00001892-10696-1505-00978AAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" writes to a file \"%APPDATA%\\123.exe\"\n \"svhost.exe\" writes to a file \"%APPDATA%\\svhost.exe\"\n \"4.exe\" writes to a file \"%APPDATA%\\4.EXE\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"svhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\123.EXE\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\123.EXE\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVHOST.EXE\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVHOST.EXE\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\4.EXE\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\4.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Process Wher\" (Indicator: \" Win32_Process\"; Source: \"00000000-00000976-00000CB4-284379335\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 147048)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00001892)\n \"4.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00000976)\n \"4.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00000976)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\123.exe\"\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\svhost.exe\"\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\4.exe\"\" - (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00004368.00000000.81531.01372000.00000020.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"147.45.47.36:27667\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Wi\" (Source: 00000000-00000976-00000CB4-284351453, Indicator: \"select * from wi\")\n \"SELECT * FROM Win32_VideoControl\" (Source: 00000000-00000976-00000CB4-284361585, Indicator: \"select * from win32_videocontrol\")\n \"SELECT * FROM Win32_Process Wher\" (Source: 00000000-00000976-00000CB4-284379335, Indicator: \"select * from win32_process wher\")\n \"SELECT * FROM\" (Source: 00000000-00000976-00000CB4-284399929, Indicator: \"select * from\")\n \"SELECT * FROM Win32_OperatingSys\" (Source: 00000000-00000976-00000CB4-284472238, Indicator: \"select * from win32_operatingsys\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 9344-1034-0040FAC7\n Sleep@KERNEL32.dll at 9344-1746-00419B7B\n WaitForSingleObject@KERNEL32.DLL at 00000000-00001892-10696-392-0095FAC7\n WaitForSingleObject@KERNEL32.DLL at 00000000-00001892-10696-655-0096BE69\n Sleep@KERNEL32.DLL at 00000000-00001892-10696-657-0096C131\n Sleep@KERNEL32.DLL at 00000000-00001892-10696-672-0095F353\n Sleep@KERNEL32.DLL at 00000000-00001892-10696-1240-00969B7B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 9344-1286-0041CABE\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001892-10696-44-009777D1\n LoadLibraryW@KERNEL32.DLL at 00000000-00001892-10696-293-0095F309\n LoadLibraryExA@KERNEL32.DLL at 00000000-00001892-10696-688-0096CABE\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001892-10696-700-00971D19","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process svhost.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 4.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"123.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"svhost.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"4.EXE\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"IndexedDB\\https_www.youtube.com_0.indexeddb.leve\" (Indicator: \"youtube\"; Source: \"00000000-00000976-00000CB4-284665482\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 765E0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 68450000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"svhost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63740000\n \"4.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63740000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"svhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 643A0000\n \"svhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64B50000\n \"4.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64B50000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76C70000\n \"svhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76C70000\n \"4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76C70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"110012009e28d076@cryptbase.dll\"\n \"1500160020734368@ADVAPI32.dll\"\n \"0e000f00e4734368@ADVAPI32.dll\"\n \"0e000f0050744368@ADVAPI32.dll\"\n \"11001200d47d4368@ADVAPI32.dll\"\n \"110012007c7e4368@ADVAPI32.dll\"\n \"12001300cc7e4368@ADVAPI32.dll\"\n \"12001300387f4368@ADVAPI32.dll\"\n \"14001500e4b74368@ADVAPI32.dll\"\n \"1400150000b84368@ADVAPI32.dll\"\n \"140015001cb84368@ADVAPI32.dll\"\n \"1700180038b84368@ADVAPI32.dll\"\n \"0d000e0054b84368@ADVAPI32.dll\"\n \"1100120064b84368@ADVAPI32.dll\"\n \"110012007cb84368@ADVAPI32.dll\"\n \"0f001000ecb94368@ADVAPI32.dll\"\n \"1400150038ba4368@ADVAPI32.dll\"\n \"1400150054ba4368@ADVAPI32.dll\"\n \"0c000d00a8ba4368@ADVAPI32.dll\"\n \"0c000d00b8ba4368@ADVAPI32.dll\"\n \"0e000f00c8ba4368@ADVAPI32.dll\"\n \"0e000f00dcba4368@ADVAPI32.dll\"\n \"0b000c00f0ba4368@ADVAPI32.dll\"\n \"180019008cbd4368@RPCRT4.dll\"\n \"13001400bcbd4368@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$37","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"svhost.exe\" (UID: 00000000-00004368) was launched with new environment variables: \"sfxcmd=\"\"C:\\c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\"\", sfxname=\"C:\\c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\", USERDNSDOMAIN=\"%OSUSER%-PC\", sfxstime=\"2026-09-08-21-32-18-592\"\"\n Process \"svhost.exe\" (UID: 00000000-00004368) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"svhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"svhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00001892.00000000.80480.00400000.00000004.mdmp, 00000000-00001892.00000001.81286.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" searching for class \"EDIT\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"svhost.exe\" (UID: 00000000-00004368)\n Spawned process \"4.exe\" (UID: 00000000-00000976)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"svhost.exe\" (UID: 00000000-00004368)\n Spawned process \"4.exe\" (UID: 00000000-00000976)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 2460435)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"4.EXE\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" connecting to \"\\ThemeApiPort\"\n \"4.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"123.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%APPDATA%\\123.exe]- [targetUID: 00000000-00001892]\n \"svhost.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\svhost.exe]- [targetUID: 00000000-00004368]\n \"4.EXE\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\4.EXE]- [targetUID: 00000000-00000976]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"4.exe\" queries basic process information of the \"C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\\comctl32.dll\" (UID: 976)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" reads file \"c:\\c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\svhost.exe\"\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\123.exe\"\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\4.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000976-00000C2C-294000297\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000976-00000C2C-293985867\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"UuwbNnHqDzdSMTPnWAiu\" (Indicator: \"smtp\"; File: \"00000000-00004368.00000000.81531.01372000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"147.45.47.36:27667\"\n \"185.172.128.70:3\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"\n \"47.45.47.36:27667\"\n Potential IP \"4.0.0.0\" found in string \"ternals,4.0.0.0,,31b\"\n Potential IP \"4.0.0.0\" found in string \"Services,4.0.0.0,,31\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00000976\"\n YARA signature for AES encryption matched on process \"00000000-00001892\"\n YARA signature for AES encryption matched on file \"4.EXE\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"4.EXE\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"4.EXE\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" tries to directly access volume data \"C:\"\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"svhost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00004368.00000000.81531.01372000.00000020.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00004368.00000000.81531.01372000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")\n Found string \"GetMac\" (Indicator: \"getmac\"; Source: \"00000000-00000976.00000001.83461.003F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"4.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_Process Wher\" (Indicator: \" Win32_Process\"; Source: \"00000000-00000976-00000CB4-284379335\")\n Found string \"AntivirusProduct|AntiSpyWareProduct|FirewallProd\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00000976-00000CB4-284394599\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\\comctl32.dll\" (UID: 00000000-00000976)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$42","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" opened \"\\Device\\KsecDD\"\n \"svhost.exe\" opened \"\\Device\\KsecDD\"\n \"4.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001892.00000000.80480.6E3F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"123.exe\" - Location: [%APPDATA%\\123.exe]- [targetUID: 00000000-00001892]\n Dropped file: \"svhost.exe\" - Location: [%APPDATA%\\svhost.exe]- [targetUID: 00000000-00004368]\n Dropped file: \"4.EXE\" - Location: [%APPDATA%\\4.EXE]- [targetUID: 00000000-00000976]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00001892-10696-59-00975B53\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00001892-10696-712-0096DA75","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"4.exe\" at 00000000-00000976-00000105-4926908","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"\\qemu-ga.exe\" (Indicator: \"qemu-ga.exe\"; Source: \"00000000-00000976-00000CB4-284859783\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00001892-10696-21-0096D8B6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 9344-1276-0041C7FD\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00001892-10696-120-00974ADF\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001892-10696-129-00974A9B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001892-10696-424-0095CE48\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001892-10696-657-0096C131\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001892-10696-672-0095F353\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001892-10696-678-0096C7FD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextW@USER32.DLL at 00000000-00001892-10696-263-0095CED7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 9344-1412-00427056\n GetStartupInfoW@KERNEL32.DLL at 00000000-00001892-10696-735-0096DB90\n GetStartupInfoW@KERNEL32.DLL at 00000000-00001892-10696-902-00977056","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00001892-10696-263-0095CED7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_Process Wher\" (Indicator: \" win32_process\"; Source: \"00000000-00000976-00000CB4-284379335\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/26 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00001892-10696-424-0095CE48\n FindResourceW@KERNEL32.DLL at 00000000-00001892-10696-648-00968BD0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"123.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%APPDATA%\\123.exe]- [targetUID: 00000000-00001892]\n \"svhost.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\svhost.exe]- [targetUID: 00000000-00004368]\n \"4.EXE\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\4.EXE]- [targetUID: 00000000-00000976]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$46","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%APPDATA%\\4.exe\" connects to 147.45.47.36 on port 27667 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\__tmp_rar_sfx_access_check_907588591\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\__tmp_rar_sfx_access_check_907588591\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%APPDATA%\\svhost.exe\" spawned likely due to injection\n Process \"%APPDATA%\\4.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\123.exe\"\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\svhost.exe\"\" - (UID: 00000000-00001892)\n \"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\4.exe\"\" - (UID: 00000000-00001892)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/23 Antivirus vendors marked dropped file \"123.exe\" as malicious (classified as \"Win64.GenKryptik\" with 60% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 147.45.47.36 on port 27667","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_MetaStealer\" matched file \"4.EXE\" as \"Detects MetaStealer infostealer\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Bypasss.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"Bypasss.exe\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006864.00000000.150129.1F102000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007304.00000001.151643.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"EnumQueryServicesStatus:OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"StartService: OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.150129.5DC50000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"svhost.exe\"\n Observed function \"System.Load\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"4.EXE\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"svhost.exe\"\n Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"svhost.exe has big resource with name: \"cykc7zdspkrdbcvlcr2soxouz\" size: \"139264\" and abnormal entropy:\"7.99859405041\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133619097508492090.6864.DefaultAppDomain.powershell; Source: \"00000000-00006864-00000C52-1358771762\")\n Found string - \\\\.\\PHYSICALDRIVE0; Source: \"00000000-00007304.00000001.151643.1EE15000.00000004.mdmp, 00000000-00007304.00000002.153564.1EE15000.00000004.mdmp\")\n Found string - \\.\\PHYSICALDRIVE0; Source: \"00000000-00007304.00000001.151643.21F10000.00000004.mdmp, 00000000-00007304.00000002.153564.21F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Bypasss.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Bypasss.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Bypasss.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"ToBase64String\" in \"svhost.exe\"\n Observed function \"FromBase64String\" in \"svhost.exe\"\n Observed function \"FromBase64CharArray\" in \"4.EXE\"\n Observed function \"FromBase64String\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"svhost.exe\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"svhost.exe\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"4.EXE\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007304.00000000.149723.05090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"4.EXE\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"4.EXE\"\n Observed namespace \"System.Security.Cryptography.AesManaged\" and TypeReference \".ctor\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007304.00000000.149723.05090000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007304.00000000.149723.05090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006864)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"svhost.exe\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"svhost.exe\"\n Observed function \"get_MachineName\" in \"svhost.exe\"\n Observed function \"get_SystemDirectory\" in \"svhost.exe\"\n Observed function \"GetLogicalDrives\" in \"4.EXE\"\n Observed function \"get_MachineName\" in \"4.EXE\"\n Observed function \"get_UserName\" in \"4.EXE\"\n Observed function \"get_Is64BitOperatingSystem\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Bypasss.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"Bypasss.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"Bypasss.exe\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00006864.00000000.150129.1F102000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$49","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006864-00000C15-1360426226","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve disk information","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00007304.00000001.151643.21F10000.00000004.mdmp, 00000000-00007304.00000002.153564.21F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-514","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133619097508492090.6864.DefaultAppDomain.powershell\" - (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007304.00000001.151643.00B62000.00000002.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007972.00000000.149715.00972000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"Bypasss.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 147048)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Bypasss.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Bypasss.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006864.00000000.150129.1F102000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007304.00000000.149723.05090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"svhost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"svhost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"svhost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"svhost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"4.EXE\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"4.EXE\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133619097508492090.6864.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1F110000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM Wi\" (Source: 00000000-00007304-00000C97-1352499880, Indicator: \"select * from wi\")\n \"SELECT * FROM Win32_VideoControl\" (Source: 00000000-00007304-00000C97-1352511560, Indicator: \"select * from win32_videocontrol\")\n \"SELECT * FROM Win32_Process Wher\" (Source: 00000000-00007304-00000C97-1352651189, Indicator: \"select * from win32_process wher\")\n \"SELECT * FROM\" (Source: 00000000-00007304-00000C97-1352693880, Indicator: \"select * from\")\n \"SELECT * FROM Win32_OperatingSys\" (Source: 00000000-00007304-00000C97-1352793952, Indicator: \"select * from win32_operatingsys\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"svhost.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"4.EXE\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Bypasss.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Bypasss.exe\" has an executable section named \".text\"\n \"gfqyepapamry.exe\" has an executable section named \".text\"\n \"svhost.exe\" has an executable section named \".text\"\n \"4.EXE\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Bypasss.exe\" has an writable section named \".data\"\n \"gfqyepapamry.exe\" has an writable section named \".data\"\n \"gfqyepapamry.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x27d600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x27e6e0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"gfqyepapamry.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005580-00000BC0-1353891401]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005580-00000BC0-1376042594]\n Observed system executable string:\"%WINDIR%\\System32\\sc.exe\" [Source: 00000000-00005580-00000BC0-1376062282]\n Observed system executable string:\"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00006864-00000BC0-1359413302]\n Observed system executable string:\"%WINDIR%\\System32\\wusa.exe\" [Source: 00000000-00002520-00000BC0-1379559137]\n Observed system executable string:\"%WINDIR%\\system32\\wusa.exe\" [Source: 00000000-00002520-00000C41-8234080066]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 2460435)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_njmoaxlw.0au.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_znebdhae.ph3.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00004596.00000000.153866.6EDAB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Bypasss.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"4.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007304)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"svhost.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\svhost.exe.log\"\n \"svhost.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\svhost.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"4.EXE\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"4.EXE\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveBufferSize\" in \"svhost.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"svhost.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"svhost.exe\"\n Observed namespace \"System.Net.Security\" in \"svhost.exe\"\n Observed namespace \"System.Net.NetworkInformation\" in \"4.EXE\"\n Observed namespace \"System.Net\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"4.EXE\"\n YARA signature for AES encryption matched on process \"00000000-00007304\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Bypasss.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1728120781\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Bypasss.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2113997337\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Bypasss.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"184616774\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"cx\": \"1\"\n \"cy\": \"1\"}\n \"4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"604047349\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"67176978\"\n \"cx\": \"160\"\n \"cy\": \"28\"}\n \"4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"184616774\"\n \"cx\": \"1280\"\n \"cy\": \"800\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"4.exe\" called \"GetComputerNameW\" (UID: 00000000-00007304)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"4.exe\" called \"GetUserNameW\" (UID: 00000000-00007304)\n \"4.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"4.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006864)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"4.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"21f5d570\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Bypasss.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"Bypasss.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"Bypasss.exe\")\n Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00007972.00000000.149715.00972000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screenshot","description":"Observed function \"System.Drawing.CopyFromScreen\" in \"svhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007304.00000001.151643.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"4.EXE\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"Bypasss.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"Bypasss.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00006864.00000000.150129.72CDA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00007304.00000000.149723.05090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006864.00000000.150129.1F102000.00000002.mdmp\")\n Found reference to API \"43479844835,4168,3024,,RtlGetVersion,NTDLL.dll,\"00:39:12.953\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007304.00000001.151643.1EE15000.00000004.mdmp, 00000000-00007304.00000002.153564.1EE15000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Bypasss.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00007304-00000C28-40988233398\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00007304-00000C28-41013965998\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00007304-00000C28-41067512961\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00007304-00000C28-41099452520\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Bypasss.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"Bypasss.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"4.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00007304-00000C97-1352984057\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00007304-00000C97-1352986069\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"123.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"6D14881FDDB5DA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (UID: 00000000-00006864)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Bypasss.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"svhost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"4.EXE\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"C:\\Windows\\System32\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"C:\\Windows\\System32\\RuntimeBroker.exe -Embedding\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"svhost.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7972)\n \"4.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7304)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"Found string \"\\qemu-ga.exe\" (Indicator: \"qemu-ga.exe\"; Source: \"00000000-00007304-00000C97-1353061225\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 23\" (SID: 2400022, Rev: 3978, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET INFO Microsoft net.tcp Connection Initialization Activity\" (SID: 2043233, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindFirstFileW\n GetFileAttributesW\n OpenFileMappingW\n GetTempPathW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n WriteFile\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n CreateFileW\n GetSystemInfo\n LockResource\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleW\n FindResourceW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"4.EXE\" claims program is from Fri Jan 20 10:38:57 2068","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$51","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$52","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"stop wuauserv\" (Indicator: \"wuauserv\") in Source: sc.exe","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"System Security","name":"Stops/delete service using SC.exe","description":"Process \"sc.exe\" with commandline \"stop UsoSvc\" (UID: 00000000-00001580)\n Process \"sc.exe\" with commandline \"stop WaaSMedicSvc\" (UID: 00000000-00002128)\n Process \"sc.exe\" with commandline \"stop wuauserv\" (UID: 00000000-00002896)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-150","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"Bypasss.exe\" (UID: 00000000-00002588)\n Spawned process \"123.exe\" (UID: 00000000-00005580)\n Spawned process \"svhost.exe\" (UID: 00000000-00007972)\n Spawned process \"4.exe\" (UID: 00000000-00007304)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (UID: 00000000-00006864)\n Spawned process \"cmd.exe\" with commandline \"/c wusa /uninstall /kb:890830 /quiet /norestart\" (UID: 00000000-00002520)\n Spawned process \"sc.exe\" with commandline \"stop UsoSvc\" (UID: 00000000-00001580)\n Spawned process \"wusa.exe\" with commandline \"wusa /uninstall /kb:890830 /quiet /norestart\" (UID: 00000000-00005388)\n Spawned process \"sc.exe\" with commandline \"stop WaaSMedicSvc\" (UID: 00000000-00002128)\n Spawned process \"sc.exe\" with commandline \"stop wuauserv\" (UID: 00000000-00002896)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"wusa.exe\" called \"RemoveDirectoryW\" with parameter C:\\9c8722d311db33a210da843ab3 (UID: 00000000-00001168)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$53","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < > D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00002040.00000001.206351.1D030000.00000004.mdmp, 00000000-00002040.00000002.207066.1D030000.00000004.mdmp\")\n Found string \"! \" # $ % & ' ( ) * + \n - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00002040.00000002.207066.1CE40000.00000004.mdmp\"), Found string \"[ \\ ] ^ _ ` i\" (Indicator: \" ^ \"; Source: \"00000000-00002040.00000002.207066.1CE40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002040.00000001.206351.1C909000.00000004.mdmp, 00000000-00002040.00000002.207066.1C7D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"C:\\Windows\\system32\\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00002040.00000001.206351.1C94A000.00000004.mdmp, 00000000-00002040.00000001.206351.201C0000.00000004.mdmp, 00000000-00002040.00000001.206351.201E1000.00000004.mdmp, 00000000-00002040.00000002.207066.1C7D0000.00000004.mdmp, 00000000-00002040.00000002.207066.201C0000.00000004.mdmp\")\n Found string \"C:\\Windows\\system32\\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002040.00000001.206351.1C94A000.00000004.mdmp, 00000000-00002040.00000001.206351.201C0000.00000004.mdmp, 00000000-00002040.00000001.206351.201E1000.00000004.mdmp, 00000000-00002040.00000002.207066.1C7D0000.00000004.mdmp, 00000000-00002040.00000002.207066.201C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004352.00000000.203790.00DD0000.00000002.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004352.00000000.203790.00DD0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"svhost.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002540)\n \"4.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002040)\n \"wusa.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001168)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1dd42c80\"\n \"lpszHeaders\": \"If-None-Match: \\\"08f5ab0361ad71:0\\\"If-Modified-Since: Tue, 16 Mar 2021 07:33:42 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1dd42c80\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"lsm.exe,csrss.exe,lsass.exe,svchost.exe,spoolsv.exe\" (Source: \"00000000-00002040.00000001.206351.1C7D0000.00000004.mdmp, 00000000-00002040.00000001.206351.201C0000.00000004.mdmp, 00000000-00002040.00000002.207066.1C7D0000.00000004.mdmp, 00000000-00002040.00000002.207066.201C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003352)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"4.exe\" (Thread ID: 2788) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"svhost.exe\" sleeping for \"1566804069\" milliseconds\n \"4.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"4.exe\" had access to \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (Type: \"FileHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable (GUI) x86-64 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\rpsbjgoyhvql\\gfqyepapamry.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$55","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"4.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BITCOIN\\WALLETS\"\n \"4.exe\" opened file \"%APPDATA%\\BITCOIN\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"4.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\COINOMI\\COINOMI\\WALLETS\"\n \"4.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"4.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"4.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"4.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\Documents\\MONERO\\WALLETS\"\n \"4.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRONCASH\\WALLETS\"\n \"4.exe\" trying to touch file \"%LOCALAPPDATA%\\COINOMI\\COINOMI\\WALLETS\"\n \"4.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"4.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"4.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"4.exe\" trying to touch file \"%USERPROFILE%\\Documents\\MONERO\\WALLETS\"\n \"4.exe\" trying to touch file \"%APPDATA%\\ELECTRONCASH\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start \"NUOIJWEW\"\" (UID: 00000000-00004764)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"intel_graph":{"map":{"File:52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1":{"type":"File","value":"52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1"},"File:5692da5cbc5c6a1d0f65e8450d0619dcbab2c8a28577776b98deb09b61ff7b93":{"type":"File","value":"5692da5cbc5c6a1d0f65e8450d0619dcbab2c8a28577776b98deb09b61ff7b93"},"File:593d382c42214728893acb29c590bc0624cbae022c3482216e791acb83f5b153":{"type":"File","value":"593d382c42214728893acb29c590bc0624cbae022c3482216e791acb83f5b153"},"File:6533e7555f0a6925fb3c1e0d413f153d7cce1b311f50cfaf4fd7877ecceee589":{"type":"File","value":"6533e7555f0a6925fb3c1e0d413f153d7cce1b311f50cfaf4fd7877ecceee589"},"File:7061f3d97ac28687798831bc212a42f0d58bdf6e8a2d15646314f1ba3575d33c":{"type":"File","value":"7061f3d97ac28687798831bc212a42f0d58bdf6e8a2d15646314f1ba3575d33c"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71":{"type":"File","value":"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71"},"File:ce51ed0339a350243bc1576fcfa76e1b589908055f24123c9816f0dc8bf8c22a":{"type":"File","value":"ce51ed0339a350243bc1576fcfa76e1b589908055f24123c9816f0dc8bf8c22a"},"Ip:147.45.47.36":{"type":"Ip","value":"147.45.47.36"}},"chains":[{"id":"sandbox_network","root":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","edges":[{"edge_kind":"contacted_ip","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"Ip:147.45.47.36"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","edges":[{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:ce51ed0339a350243bc1576fcfa76e1b589908055f24123c9816f0dc8bf8c22a"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:7061f3d97ac28687798831bc212a42f0d58bdf6e8a2d15646314f1ba3575d33c"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:6533e7555f0a6925fb3c1e0d413f153d7cce1b311f50cfaf4fd7877ecceee589"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:593d382c42214728893acb29c590bc0624cbae022c3482216e791acb83f5b153"},{"edge_kind":"extracted","from_key":"File:c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","to_key":"File:5692da5cbc5c6a1d0f65e8450d0619dcbab2c8a28577776b98deb09b61ff7b93"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":27,"spawned_processes_count":27,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":200,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":23,"files_deleted_count":0,"registry_keys_created_count":25,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","redlinestealer","informationstealer","backdoor","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aa062ad1b734eafd20698a6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["RUS"],"submit_name":"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","analysis_start_time":"2026-09-08T19:31:58+00:00","indicators_count":{"informative":200,"suspicious":46,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"665d9c62288b7e97ce082d4c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"Bypasss.exe","analysis_start_time":"2024-06-03T10:35:15+00:00","indicators_count":{"informative":229,"suspicious":57,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"665d9c337ae7df3fb602a30d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"Bypasss.exe","analysis_start_time":"2024-06-03T10:34:27+00:00","indicators_count":{"informative":218,"suspicious":67,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"147.45.47.36","port":27667,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}],"processes":[{"pid":4352,"ppid":0,"name":"Bypasss.exe","command_line":"","sha256":"c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71","normalized_path":"C:\\Bypasss.exe","uid":"00000000-00004352","icon":"$56"},{"pid":3724,"ppid":4352,"name":"123.exe","command_line":"","sha256":"52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1","normalized_path":"%APPDATA%\\123.exe","parent_uid":"00000000-00004352","uid":"00000000-00003724"},{"pid":3352,"ppid":3724,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003724","uid":"00000000-00003352"},{"pid":4844,"ppid":3724,"name":"cmd.exe","command_line":"/c wusa /uninstall /kb:890830 /quiet /norestart","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003724","uid":"00000000-00004844"},{"pid":1168,"ppid":4844,"name":"wusa.exe","command_line":"wusa /uninstall /kb:890830 /quiet /norestart","sha256":"8f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3","normalized_path":"%WINDIR%\\system32\\wusa.exe","parent_uid":"00000000-00004844","uid":"00000000-00001168"},{"pid":4976,"ppid":3724,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00004976"},{"pid":2388,"ppid":3724,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00002388"},{"pid":420,"ppid":3724,"name":"sc.exe","command_line":"stop wuauserv","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00000420"},{"pid":2436,"ppid":3724,"name":"sc.exe","command_line":"stop bits","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00002436"},{"pid":2344,"ppid":3724,"name":"sc.exe","command_line":"stop dosvc","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00002344"},{"pid":4780,"ppid":3724,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-ac 0","sha256":"12279d4d2d7f80562f79d4dbcb7b63428e924c30a5e95f45cb0d08001a9cbddc","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00003724","uid":"00000000-00004780"},{"pid":3948,"ppid":3724,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-dc 0","sha256":"12279d4d2d7f80562f79d4dbcb7b63428e924c30a5e95f45cb0d08001a9cbddc","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00003724","uid":"00000000-00003948"},{"pid":1852,"ppid":3724,"name":"powercfg.exe","command_line":"/x -standby-timeout-ac 0","sha256":"12279d4d2d7f80562f79d4dbcb7b63428e924c30a5e95f45cb0d08001a9cbddc","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00003724","uid":"00000000-00001852"},{"pid":2096,"ppid":3724,"name":"powercfg.exe","command_line":"/x -standby-timeout-dc 0","sha256":"12279d4d2d7f80562f79d4dbcb7b63428e924c30a5e95f45cb0d08001a9cbddc","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00003724","uid":"00000000-00002096"},{"pid":4836,"ppid":3724,"name":"sc.exe","command_line":"delete \"NUOIJWEW\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00004836"},{"pid":1308,"ppid":3724,"name":"sc.exe","command_line":"create \"NUOIJWEW\" binpath= \"%ALLUSERSPROFILE%\\rpsbjgoyhvql\\gfqyepapamry.exe\" start= \"auto\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00001308"},{"pid":3404,"ppid":3724,"name":"sc.exe","command_line":"stop eventlog","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00003404"},{"pid":4764,"ppid":3724,"name":"sc.exe","command_line":"start \"NUOIJWEW\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00003724","uid":"00000000-00004764"},{"pid":2540,"ppid":4352,"name":"svhost.exe","command_line":"","sha256":"ce51ed0339a350243bc1576fcfa76e1b589908055f24123c9816f0dc8bf8c22a","normalized_path":"%APPDATA%\\svhost.exe","parent_uid":"00000000-00004352","uid":"00000000-00002540"},{"pid":2040,"ppid":4352,"name":"4.exe","command_line":"","sha256":"7061f3d97ac28687798831bc212a42f0d58bdf6e8a2d15646314f1ba3575d33c","normalized_path":"%APPDATA%\\4.exe","parent_uid":"00000000-00004352","uid":"00000000-00002040"},{"pid":2672,"ppid":0,"name":"cmd.exe","command_line":"/c wusa /uninstall /kb:890830 /quiet /norestart","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00002672","icon":"$57"},{"pid":3528,"ppid":2672,"name":"wusa.exe","command_line":"wusa /uninstall /kb:890830 /quiet /norestart","sha256":"8f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3","normalized_path":"%WINDIR%\\system32\\wusa.exe","parent_uid":"00000000-00002672","uid":"00000000-00003528"},{"pid":1692,"ppid":0,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00001692","icon":"$58"},{"pid":4236,"ppid":0,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00004236","icon":"$59"},{"pid":2856,"ppid":0,"name":"sc.exe","command_line":"stop wuauserv","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00002856","icon":"$5a"},{"pid":3272,"ppid":0,"name":"sc.exe","command_line":"stop bits","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00003272","icon":"$5b"},{"pid":4280,"ppid":0,"name":"sc.exe","command_line":"stop dosvc","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00004280","icon":"$5c"}],"all_imported_dlls":["ucrtbase_clr0400.dll","api-ms-win-core-xstate-l2-1-0.dll","clrjit.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","cfgmgr32.dll","psapi.dll","System.ni.dll","System.Drawing.ni.dll","System.Xml.ni.dll","lpk.dll","sfc_os.dll","sechost.dll","clbcatq.dll","shdocvw.dll","mscoree.dll","System.Windows.Forms.dll","System.Transactions.ni.dll","cryptbase.dll","VxSSL32.dll","nsi.dll","profapi.dll","duser.dll","xmllite.dll","mscoreei.dll","System.Core.ni.dll","vcruntime140.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","rpcss.dll","urlmon.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","imageres.dll","bcrypt.dll","shlwapi.dll","comctl32.dll","tiptsf.dll","KernelBase.dll","usp10.dll","rsaenh.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","ntdll.dll","GdiPlus.dll","api-ms-win-crt-string-l1-1-0.dll","oleaut32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","iertutil.dll","secur32.dll","clr.dll","msvcp140.dll","WindowsCodecs.dll","System.Runtime.Serialization.ni.dll","System.ServiceModel.Internals.dll","mswsock.dll","msctf.dll","devobj.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","SMDiagnostics.ni.dll","System.Transactions.dll","WSHTCPIP.DLL","wship6.dll","ws2_32.dll","Wldap32.dll","dwmapi.dll","riched20.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","nlssorting.dll","System.Configuration.ni.dll","System.ServiceModel.dll","imm32.dll","ntmarta.dll","cryptsp.dll","System.Windows.Forms.ni.dll","System.IdentityModel.ni.dll","propsys.dll","msvcrt.dll","ucrtbase.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","diasymreader.dll","gdi32.dll","ole32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","version.dll","fltLib.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","shell32.dll","apphelp.dll","kernel32.dll","uxtheme.dll","advapi32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","normaliz.dll","wininet.dll","user32.dll","rpcrt4.dll","sspicli.dll","api-ms-win-core-processthreads-l1-1-1.dll","setupapi.dll","System.Management.ni.dll","wldp.dll","wbemprox.dll","fastprox.dll","edputil.dll","mpr.dll","msvcp_win.dll","CoreMessaging.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","msls31.dll","System.Numerics.ni.dll","MpOAV.dll","dpapi.dll","miutils.dll","SHCore.dll","cldapi.dll","System.Data.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","msIso.dll","gpapi.dll","MpClient.dll","sppc.dll","kernel.appcore.dll","Microsoft.Management.Infrastructure.ni.dll","System.Data.dll","amsi.dll","wow64.dll","bcryptprimitives.dll","webengine4.dll","Windows.StateRepositoryPS.dll","aepic.dll","System.DirectoryServices.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","DWrite.dll","windows.storage.dll","wmiutils.dll","dpx.dll","pcacli.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.Security.ni.dll","combase.dll","imagehlp.dll","atl.dll","powrprof.dll","VxSSL64.dll","crypt32.dll","wmidcom.dll","wow64win.dll","win32u.dll","wintrust.dll","slc.dll","System.ServiceModel.ni.dll","mi.dll","wow64cpu.dll","Microsoft.PowerShell.Commands.Management.ni.dll","wtsapi32.dll","wbemsvc.dll","gdi32full.dll","msasn1.dll","wbemcomn.dll","WMINet_Utils.dll","cbJk158P.dll","System.Web.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll","ntdsapi.dll","comdlg32.dll","CbsApi.dll","RpcRtRemote.dll","rasadhlp.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","pwrshsip.dll","winbrand.dll","FWPUCLNT.DLL","netmsg.dll","msisip.dll","dnsapi.dll","IPHLPAPI.DLL","winhttp.dll","webio.dll","mscorrc.dll","SensApi.dll","aspnet_rc.dll","wshext.dll","credssp.dll","ncrypt.dll","cryptnet.dll","dhcpcsvc.dll","wbemcomn2.dll","dhcpcsvc6.dll","winnsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"123.exe","sha256":"52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"svhost.exe","sha256":"ce51ed0339a350243bc1576fcfa76e1b589908055f24123c9816f0dc8bf8c22a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"4.EXE","sha256":"7061f3d97ac28687798831bc212a42f0d58bdf6e8a2d15646314f1ba3575d33c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"svhost.exe.log","sha256":"6533e7555f0a6925fb3c1e0d413f153d7cce1b311f50cfaf4fd7877ecceee589","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"gfqyepapamry.exe","sha256":"52c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"4.exe.log","sha256":"593d382c42214728893acb29c590bc0624cbae022c3482216e791acb83f5b153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"5692da5cbc5c6a1d0f65e8450d0619dcbab2c8a28577776b98deb09b61ff7b93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"files_written":[{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%APPDATA%\\__tmp_rar_sfx_access_check_907588591","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"path":"%APPDATA%\\svhost.exe","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%APPDATA%\\123.exe","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%APPDATA%\\4.EXE","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%APPDATA%\\__tmp_rar_sfx_access_check_908666968","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_njmoaxlw.0au.ps1","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_znebdhae.ph3.psm1","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\svhost.exe.log","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%APPDATA%\\__tmp_rar_sfx_access_check_909512645","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%ALLUSERSPROFILE%\\rpsbjgoyhvql\\gfqyepapamry.exe","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{A3C5A950-CBBD-4EFA-9430-4E8BB4184281}","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%TEMP%\\omghg3c2.42o.ps1","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"path":"%TEMP%\\ynxm3wxn.240.psm1","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MRT\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa062ad1b734eafd20698a6"}]},{"name":"Local\\SM0:2588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"Local\\SM0:2588:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"},{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]},{"name":"SM0:2588:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"SM0:2588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6864:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"SM0:7972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"Local\\SM0:7304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"SM0:7304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"SM0:7304:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"Local\\SM0:6864:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"SM0:6864:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"SM0:6864:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6864:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6864:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7304:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"665d9c62288b7e97ce082d4c"}]},{"name":"\\BaseNamedObjects\\kdnybcffmjhrcizfllczqchj","sources":[{"report_type":"sandbox","report_id":"665d9c337ae7df3fb602a30d"}]}]}},"report_ids":{"sandbox_job_ids":["6aa062ad1b734eafd20698a6","665d9c62288b7e97ce082d4c","665d9c337ae7df3fb602a30d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c54eb244078d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c54eb244078d…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 16 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c54eb244078d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c54eb244078d…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 16 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c54eb244078d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c54eb244078d…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 16 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]]