26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c5f49c0f566a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c5f49c0f566a…. Malware family: Trojan.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7"],"about":{"@type":"SoftwareApplication","name":"0F6D6EF9B82ECE9DBBDC711AC00B5E6A.bin","applicationCategory":["peexe","executable"],"identifier":"c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":24},"behavioralIndicators":{"malicious":4,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c9,Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "my_testfile") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "my_testfile") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "my_testfile") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "my_testfile") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; File: "my_testfile") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")28:Tfad,Found reference to "README.HAes." (Indicator: "Aes"; File: "screen_5.png") Found reference to "README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp") Found reference to ".HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp") Found reference to "HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp") Found reference to ":\\README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to ":\\Users\HAPUBWS\README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\$WINDOWS.~BT\Sources\replacementmanifests\README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to ":\\PerfLogs\Admin\README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to ":\\Users\Default\README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to ":\\found.000\dir0002.chk\$filehashes$.dat.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to ":\\BOOTNXT.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\$WINDOWS.~BT\Sources\setupplatform.cfg.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\found.000\dir0002.chk\$filehashes$.dat.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\$WINDOWS.~BT\Sources\upgrade_bulk.xml.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "\??\C:\found.000\dir0001.chk\update.cat.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "\??\C:\$WINDOWS.~BT\Sources\SFPATWT.INF.HAest" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "\??\C:\$WINDOWS.~BT\Sources\nxquery.inf.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "\??\C:\found.000\dir0001.chk\update.mum.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\System Volume Information\README.HAes.txt" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\$WINDOWS.~BT\Sources\SFLISTWT.WOA.DAT.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "\??\C:\$WINDOWS.~BT\Sources\SFPAT.INF.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\found.000\dir0001.chk\update.cat.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\$WINDOWS.~BT\Sources\SFPATWT.INF.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\found.000\dir0001.chk\update.mum.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to "??\C:\$WINDOWS.~BT\Sources\SFPAT.INF.HAes" (Indicator: "Aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp")29:T1990,"my_testfile.exe" renamed original file"C:\$MAPFAILURE" to "C:\$MAPFAILURE.HAes" "my_testfile.exe" renamed original file"C:\bootmgr" to "C:\bootmgr.HAes" "my_testfile.exe" renamed original file"C:\$WINDOWS.~BT\Sources\appraiser.sdb" to "C:\$WINDOWS.~BT\Sources\appraiser.sdb.HAes" "my_testfile.exe" renamed original file"C:\$WINDOWS.~BT\Sources\SFLISTWT.DAT" to "C:\$WINDOWS.~BT\Sources\SFLISTWT.DAT.HAes" "my_testfile.exe" renamed original file"C:\$WINDOWS.~BT\Sources\SFPAT.INF" to "C:\$WINDOWS.~BT\Sources\SFPAT.INF.HAes" "my_testfile.exe" renamed original file"C:\$WINDOWS.~BT\Sources\SFPATWT.INF" to "C:\$WINDOWS.~BT\Sources\SFPATWT.INF.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\$filehashes$.dat" to "C:\found.000\dir0001.chk\$filehashes$.dat.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest.HAes" "my_testfile.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest.HAes"2a:T114b,"my_testfile.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824) "my_testfile.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824) "my_testfile.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000068df0f010cdf0f01226e2d7600008203000000002d6e2d76ce9193062d000000ecb7f77490df0f010000d70068952c0310ac2b031c00000080000000d0de0f010000d70054df0f0170c82e763a3faf71feffffff2d000000d0cc06752700000024df0f01856a2f761c23347664df0f01f85f2f7608000000bb692e76b2692e76a69193062d000000ecb7f77427000000d0cc067538df0f012d000000d0cc06752700000068df0f01856a2f761c233476b0df0f017e8a0575ee8c0575738a0575931381aa2d000000ecb7f77427000000d0cc06751c258203b0248203931381aa78df0f01fc52437564e00f01e08405751b3dcfdefeffffff738a0575 (UID: 00000000-00007824) "my_testfile.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0010000020000000000000000000000d007d7002800000000000000360000000000d70000000000c20000000000000078cf0f018809300300a02d030d00000000000000200000000000d700cc01d7000000d700000000006808d7000000000080dc0f015916057720000000080014000000000000002b0300000000280000000000000050f504770500000005000000f03c2f0320000000a01f2f03803b2f030a00000094dc0f015243087743000000e8dc0f0173f6b874a0dd0f015c0000000000000038ffff7f82f8b87400000000b8fdffff45ffffff0000000000000000000000000b000000fedf0f01bb000000bb000000040100006cdf0f01 (UID: 00000000-00007824) "my_testfile.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005628) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005628)2b:Td10,"my_testfile.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2c:T481,"my_testfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007824) "my_testfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007824) "my_testfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007824) "my_testfile.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007824) "my_testfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007824) "my_testfile.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007824) "my_testfile.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007824) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005628) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005628) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005628) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005628)2d:T2492,"my_testfile.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007824) "my_testfile.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007824) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005628) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005628)2e:T6f23,Found reference to API (Indicator: "GetTokenInformation"; File: "my_testfile") Found reference to API (Indicator: "CloseEventLog"; File: "my_testfile") Found reference to API (Indicator: "OpenSCManagerA"; File: "my_testfile") Found reference to API (Indicator: "ControlService"; File: "my_testfile") Found reference to API (Indicator: "ClearEventLogW"; File: "my_testfile") Found reference to API (Indicator: "StartServiceW"; File: "my_testfile") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "my_testfile") Found reference to API (Indicator: "OpenEventLogW"; File: "my_testfile") Found reference to API (Indicator: "DuplicateTokenEx"; File: "my_testfile") Found reference to API (Indicator: "OpenServiceW"; File: "my_testfile") Found reference to API (Indicator: "CryptGenRandom"; File: "my_testfile") Found reference to API (Indicator: "OpenSCManagerW"; File: "my_testfile") Found reference to API (Indicator: "DeleteService"; File: "my_testfile") Found reference to API (Indicator: "OpenProcessToken"; File: "my_testfile") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "my_testfile") Found reference to API (Indicator: "RevertToSelf"; File: "my_testfile") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "my_testfile") Found reference to API (Indicator: "CloseServiceHandle"; File: "my_testfile") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "my_testfile") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "my_testfile") Found reference to API (Indicator: "IcmpSendEcho"; File: "my_testfile") Found reference to API (Indicator: "ExitProcess"; File: "my_testfile") Found reference to API (Indicator: "LoadLibraryW"; File: "my_testfile") Found reference to API (Indicator: "MultiByteToWideChar"; File: "my_testfile") Found reference to API (Indicator: "Sleep"; File: "my_testfile") Found reference to API (Indicator: "CreateFileW"; File: "my_testfile") Found reference to API (Indicator: "FindFirstFileExW"; File: "my_testfile") Found reference to API (Indicator: "DecodePointer"; File: "my_testfile") Found reference to API (Indicator: "FlsAlloc"; File: "my_testfile") Found reference to API (Indicator: "MoveFileExW"; File: "my_testfile") Found reference to API (Indicator: "GetACP"; File: "my_testfile") Found reference to API (Indicator: "GetDriveTypeW"; File: "my_testfile") Found reference to API (Indicator: "SetFilePointerEx"; File: "my_testfile") Found reference to API (Indicator: "LCMapStringW"; File: "my_testfile") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "my_testfile") Found reference to API (Indicator: "GetCurrentProcess"; File: "my_testfile") Found reference to API (Indicator: "FindNextFileW"; File: "my_testfile") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "my_testfile") Found reference to API (Indicator: "TlsGetValue"; File: "my_testfile") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "my_testfile") Found reference to API (Indicator: "EncodePointer"; File: "my_testfile") Found reference to API (Indicator: "FlsGetValue"; File: "my_testfile") Found reference to API (Indicator: "VirtualProtect"; File: "my_testfile") Found reference to API (Indicator: "WriteFile"; File: "my_testfile") Found reference to API (Indicator: "lstrlenW"; File: "my_testfile") Found reference to API (Indicator: "GetLocalTime"; File: "my_testfile") Found reference to API (Indicator: "GetStdHandle"; File: "my_testfile") Found reference to API (Indicator: "FlushFileBuffers"; File: "my_testfile") Found reference to API (Indicator: "RaiseException"; File: "my_testfile") Found reference to API (Indicator: "TlsSetValue"; File: "my_testfile") Found reference to API (Indicator: "OpenProcess"; File: "my_testfile") Found reference to API (Indicator: "HeapAlloc"; File: "my_testfile") Found reference to API (Indicator: "HeapSize"; File: "my_testfile") Found reference to API (Indicator: "LeaveCriticalSection"; File: "my_testfile") Found reference to API (Indicator: "WideCharToMultiByte"; File: "my_testfile") Found reference to API (Indicator: "FindFirstFileW"; File: "my_testfile") Found reference to API (Indicator: "GetModuleHandleExW"; File: "my_testfile") Found reference to API (Indicator: "GetModuleHandleW"; File: "my_testfile") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "my_testfile") Found reference to API (Indicator: "lstrcpyW"; File: "my_testfile") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "my_testfile") Found reference to API (Indicator: "GetCommandLineA"; File: "my_testfile") Found reference to API (Indicator: "GetFileSizeEx"; File: "my_testfile") Found reference to API (Indicator: "GetConsoleMode"; File: "my_testfile") Found reference to API (Indicator: "GetCurrentThreadId"; File: "my_testfile") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "my_testfile") Found reference to API (Indicator: "GetProcessHeap"; File: "my_testfile") Found reference to API (Indicator: "FlsFree"; File: "my_testfile") Found reference to API (Indicator: "GetProcAddress"; File: "my_testfile") Found reference to API (Indicator: "GetOEMCP"; File: "my_testfile") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "my_testfile") Found reference to API (Indicator: "GetCommandLineW"; File: "my_testfile") Found reference to API (Indicator: "FlsSetValue"; File: "my_testfile") Found reference to API (Indicator: "EnterCriticalSection"; File: "my_testfile") Found reference to API (Indicator: "HeapFree"; File: "my_testfile") Found reference to API (Indicator: "TlsAlloc"; File: "my_testfile") Found reference to API (Indicator: "LoadLibraryExW"; File: "my_testfile") Found reference to API (Indicator: "TlsFree"; File: "my_testfile") Found reference to API (Indicator: "Process32NextW"; File: "my_testfile") Found reference to API (Indicator: "GetFileType"; File: "my_testfile") Found reference to API (Indicator: "CloseHandle"; File: "my_testfile") Found reference to API (Indicator: "lstrcmpW"; File: "my_testfile") Found reference to API (Indicator: "TerminateProcess"; File: "my_testfile") Found reference to API (Indicator: "FindClose"; File: "my_testfile") Found reference to API (Indicator: "GetTickCount64"; File: "my_testfile") Found reference to API (Indicator: "CompareStringW"; File: "my_testfile") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "my_testfile") Found reference to API (Indicator: "lstrcatW"; File: "my_testfile") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "my_testfile") Found reference to API (Indicator: "FreeConsole"; File: "my_testfile") Found reference to API (Indicator: "GetLastError"; File: "my_testfile") Found reference to API (Indicator: "SetFileAttributesW"; File: "my_testfile") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "my_testfile") Found reference to API (Indicator: "GetComputerNameExW"; File: "my_testfile") Found reference to API (Indicator: "GetComputerNameW"; File: "my_testfile") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "my_testfile") Found reference to API (Indicator: "DebugBreak"; File: "my_testfile") Found reference to API (Indicator: "ReadFile"; File: "my_testfile") Found reference to API (Indicator: "IsValidCodePage"; File: "my_testfile") Found reference to API (Indicator: "GetModuleFileNameW"; File: "my_testfile") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "my_testfile") Found reference to API (Indicator: "HeapReAlloc"; File: "my_testfile") Found reference to API (Indicator: "Process32FirstW"; File: "my_testfile") Found reference to API (Indicator: "FreeLibrary"; File: "my_testfile") Found reference to API (Indicator: "GetStringTypeW"; File: "my_testfile") Found reference to API (Indicator: "SetLastError"; File: "my_testfile") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "my_testfile") Found reference to API (Indicator: "GetCurrentProcessId"; File: "my_testfile") Found reference to API (Indicator: "IsDebuggerPresent"; File: "my_testfile") Found reference to API (Indicator: "lstrcmpiW"; File: "my_testfile") Found reference to API (Indicator: "InitializeSListHead"; File: "my_testfile") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "my_testfile") Found reference to API (Indicator: "CreateProcessW"; File: "my_testfile") Found reference to API (Indicator: "SetStdHandle"; File: "my_testfile") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "my_testfile") Found reference to API (Indicator: "GetStartupInfoW"; File: "my_testfile") Found reference to API (Indicator: "GetCPInfo"; File: "my_testfile") Found reference to API (Indicator: "DeleteCriticalSection"; File: "my_testfile") Found reference to API (Indicator: "WriteConsoleW"; File: "my_testfile") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "my_testfile") Found reference to API (Indicator: "GetFileAttributesW"; File: "my_testfile") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "my_testfile") Found reference to API (Indicator: "WNetAddConnection2W"; File: "my_testfile") Found reference to API (Indicator: "NetShareEnum"; File: "my_testfile") Found reference to API (Indicator: "NetApiBufferFree"; File: "my_testfile") Found reference to API (Indicator: "wsprintfW"; File: "my_testfile") Found reference to API (Indicator: "inet_addr"; File: "my_testfile") Found reference to API (Indicator: "WSAStartup"; File: "my_testfile") Found reference to API (Indicator: "NtDelayExecution"; File: "my_testfile") Found reference to API (Indicator: "RtlUnwind"; File: "my_testfile") Found reference to API (Indicator: "NtOpenKey"; File: "my_testfile") Found reference to API (Indicator: "NtClose"; File: "my_testfile") Found reference to API (Indicator: "NtOpenProcess"; File: "my_testfile") Found reference to API (Indicator: "NtTerminateProcess"; File: "my_testfile") Found reference to API (Indicator: "LsaConnectUntrusted"; File: "my_testfile") Found reference to API (Indicator: "LsaLookupAuthenticationPackage"; File: "my_testfile") Found reference to API (Indicator: "LsaCallAuthenticationPackage"; File: "my_testfile") Found reference to API (Indicator: "LsaDeregisterLogonProcess"; File: "my_testfile") Found reference to API (Indicator: "LsaFreeReturnBuffer"; File: "my_testfile") Found reference to API (Indicator: "CompareStringEx"; File: "my_testfile") Found reference to API (Indicator: "LCMapStringEx"; File: "my_testfile") Found reference to API (Indicator: "LocaleNameToLCID"; File: "my_testfile") Found reference to API (Indicator: "SeDebugPrivilege"; File: "my_testfile") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; File: "my_testfile") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NtOpenKey"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NtTerminateProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LsaConnectUntrusted"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupAuthenticationPackage"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LsaCallAuthenticationPackage"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LsaDeregisterLogonProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeReturnBuffer"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "ClearEventLogW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CloseEventLog"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "OpenEventLogW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NetShareEnum"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "NtDelayExecution"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")2f:T5f6,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007824.00000000.143373.032B0000.00000004.mdmp 00000000-00007824.00000001.145292.032B0000.00000004.mdmp 00000000-00007824.00000002.147215.032B0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007824.00000000.143373.032B0000.00000004.mdmp 00000000-00007824.00000001.145292.032B0000.00000004.mdmp 00000000-00007824.00000002.147215.032B0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00007824.00000000.143373.032B0000.00000004.mdmp 00000000-00007824.00000000.143373.05270000.00000002.mdmp 00000000-00007824.00000001.145292.032B0000.00000004.mdmp 00000000-00007824.00000002.147215.032B0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00007824.00000000.143373.032B0000.00000004.mdmp 00000000-00007824.00000000.143373.05270000.00000002.mdmp 00000000-00007824.00000001.145292.032B0000.00000004.mdmp 00000000-00007824.00000002.147215.032B0000.00000004.mdmp30:T7d0,"my_testfile.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74aa0000 "my_testfile.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74aa0000 "my_testfile.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74aa0000 "my_testfile.exe" loaded module "KERNEL32" at base 74040000 "my_testfile.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 724e0000 "my_testfile.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 74aa0000 "my_testfile.exe" loaded module "SHELL32.DLL" at base 74f50000 "my_testfile.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 734e0000 "my_testfile.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 742f0000 "my_testfile.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74f50000 "my_testfile.exe" loaded module "KERNEL32.DLL" at base 74040000 "my_testfile.exe" loaded module "RPCRT4.DLL" at base 74230000 "my_testfile.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72f80000 "my_testfile.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 724b0000 "my_testfile.exe" loaded module "NTDLL.DLL" at base 77010000 "my_testfile.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74130000 "cmd.exe" loaded module "KERNEL32" at base 74040000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74aa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74aa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74aa0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76f20000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74aa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74aa0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74aa0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 726b0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74040000 "cmd.exe" loaded module "NTDLL.DLL" at base 7701000031:T41c,"syncres.dll.mui.HAes" has type "DOS executable (COM)"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba\syncres.dll.mui.HAes]- [targetUID: 00000000-00007824] "memtest.efi.mui.HAes" has type "DOS executable (COM)"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_e58afb6c453b77e6\memtest.efi.mui.HAes]- [targetUID: 00000000-00007824] "README.HAes.txt" has type "ASCII text"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_6cfa7a1408593685\README.HAes.txt]- [targetUID: 00000000-00007824] "amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes" has type "DOS executable (COM)"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes]- [targetUID: 00000000-00007824]32:T6af,"my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "my_testfile.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")33:Ta95,"my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "MY_TESTFILE.EXE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")34:T48b,"my_testfile.exe" reads file "c:\$recycle.bin\s-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" "my_testfile.exe" reads file "c:\bootnxt.haes" "my_testfile.exe" reads file "c:\boottel.dat.haes" "my_testfile.exe" reads file "c:\found.000\file00000003.chk.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\hwcompat.txt.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\hwexclude.txt.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\nxquery.inf.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\reagent.admx.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\reagent.xml.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\setupplatform.cfg.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\sfcn.dat.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\sflcid.dat.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\appraiser.sdb.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\sflistrs1.dat.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\sflistwt.dat.haes" "my_testfile.exe" reads file "c:\$windows.~bt\sources\sflistwt.woa.dat.haes"35:T44c,"my_testfile.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ole32.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\system32\shell32.dll" "my_testfile.exe" trying to touch file "C:\$RECYCLE.BIN\S-1-5-21-735145574-3570218355-1207367261-1001" "my_testfile.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ntmarta.dll" "my_testfile.exe" trying to touch file "C:\WINDOWS\system32\propsys.dll" "my_testfile.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "my_testfile.exe" trying to touch file "C:\WINDOWS\system32\rsaenh.dll" "my_testfile.exe" trying to touch file "C:\" "my_testfile.exe" trying to touch file "C:\README.HAes.txt" "my_testfile.exe" trying to touch file "C:\$MAPFAILURE"36:T4be,"my_testfile.exe" writes file "c:\$mapfailure.haes" "my_testfile.exe" writes file "c:\config.msi\readme.haes.txt" "my_testfile.exe" writes file "c:\found.000\readme.haes.txt" "my_testfile.exe" writes file "c:\msocache\readme.haes.txt" "my_testfile.exe" writes file "c:\perflogs\readme.haes.txt" "my_testfile.exe" writes file "c:\recovery\readme.haes.txt" "my_testfile.exe" writes file "c:\tempdir\readme.haes.txt" "my_testfile.exe" writes file "c:\torservice\readme.haes.txt" "my_testfile.exe" writes file "c:\$recycle.bin\s-1-5-18\readme.haes.txt" "my_testfile.exe" writes file "c:\$windows.~bt\dudownload\readme.haes.txt" "my_testfile.exe" writes file "c:\found.000\dir0000.chk\readme.haes.txt" "my_testfile.exe" writes file "c:\found.000\dir0001.chk\readme.haes.txt" "my_testfile.exe" writes file "c:\found.000\dir0006.chk\readme.haes.txt" "my_testfile.exe" writes file "c:\found.000\dir0012.chk\readme.haes.txt" "my_testfile.exe" writes file "c:\torservice\data\readme.haes.txt" "my_testfile.exe" writes file "c:\users\%osuser%\readme.haes.txt" "my_testfile.exe" writes file "c:\$windows.~bt\sources\appraiser.sdb.haes" "my_testfile.exe" writes file "c:\$windows.~bt\sources\sflistwt.dat.haes"37:Tdcc,Potential IP "127.0.0.7" found in string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "%s"" Potential IP "127.0.0.7" found in string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\my_testfile.exe"" Potential IP "127.0.0.7" found in string "ping 127.0.0.7 -n 3" Potential IP "127.0.0.7" found in string "/C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\my_testfile.exe"" "92.168.0.4" "92.168.0.3" "92.168.0.1" "92.168.0.6" "92.168.0.5" "92.168.0.7" "92.168.0.57" "92.168.0.75" "92.168.0.52" "92.168.0.67" "92.168.0.72" "92.168.0.73" "92.168.0.76" "92.168.0.47" "92.168.0.61" "92.168.0.53" "92.168.0.63" "92.168.0.58" "92.168.0.65" "92.168.0.50" "92.168.0.66" "92.168.0.77" "92.168.0.68" "92.168.0.78" "92.168.0.51" "92.168.0.55" "92.168.0.70" "92.168.0.48" "92.168.0.54" "92.168.0.69" "92.168.0.56" "92.168.0.60" "92.168.0.64" "92.168.0.71" "92.168.0.74" "92.168.0.62" "92.168.0.59" "92.168.0.49" "92.168.0.81" "92.168.0.80" "92.168.0.79" "92.168.0.82" "92.168.0.83" "92.168.0.84" "92.168.0.85" "92.168.0.98" "92.168.0.102" "92.168.0.112" "92.168.0.117" "92.168.0.119" "92.168.0.120" "92.168.0.122" "92.168.0.121" "92.168.0.123" "92.168.0.113" "92.168.0.124" "92.168.0.100" "92.168.0.104" "92.168.0.109" "92.168.0.93" "92.168.0.94" "92.168.0.97" "92.168.0.96" "92.168.0.101" "92.168.0.95" "92.168.0.105" "92.168.0.110" "92.168.0.106" "92.168.0.111" "92.168.0.114" "92.168.0.115" "92.168.0.108" "92.168.0.99" "92.168.0.103" "92.168.0.116" "92.168.0.107" "92.168.0.118" "92.168.0.86" "92.168.0.87" "92.168.0.90" "92.168.0.91" "92.168.0.88" "92.168.0.89" "92.168.0.92" "92.168.0.144" "92.168.0.148" "92.168.0.127" "92.168.0.137" "92.168.0.132" "92.168.0.126" "92.168.0.133" "92.168.0.136" "92.168.0.140" "92.168.0.141" "92.168.0.145" "92.168.0.147" "92.168.0.150" "92.168.0.139" "92.168.0.151" "92.168.0.152" "92.168.0.128" "92.168.0.153" "92.168.0.130" "92.168.0.154" "92.168.0.143" "92.168.0.129" "92.168.0.131" "92.168.0.155" "92.168.0.135" "92.168.0.138" "92.168.0.156" "92.168.0.125" "92.168.0.134" "92.168.0.146" "92.168.0.149" "92.168.0.142" "92.168.0.158" "92.168.0.157" "92.168.0.160" "92.168.0.163" "92.168.0.161" "92.168.0.159" "92.168.0.162" "92.168.0.170" "92.168.0.177" "92.168.0.181" "92.168.0.186" "92.168.0.188" "92.168.0.192" "92.168.0.169" "92.168.0.187" "92.168.0.171" "92.168.0.193" "92.168.0.195" "92.168.0.167" "92.168.0.179" "92.168.0.183" "92.168.0.173" "92.168.0.176" "92.168.0.180" "92.168.0.175" "92.168.0.168" "92.168.0.174" "92.168.0.184" "92.168.0.189" "92.168.0.185" "92.168.0.190" "92.168.0.191" "92.168.0.194" "92.168.0.164" "92.168.0.165" "92.168.0.166" "92.168.0.172" "92.168.0.178" "92.168.0.182" "92.168.0.197" "92.168.0.199" "92.168.0.200" "92.168.0.198" "92.168.0.202" "92.168.0.196" "92.168.0.201" "92.168.0.222" "92.168.0.224" "92.168.0.205" "92.168.0.203" "92.168.0.207" "92.168.0.212" "92.168.0.213" "92.168.0.216" "92.168.0.217" "92.168.0.204" "92.168.0.220" "92.168.0.221" "92.168.0.225" "92.168.0.219" "92.168.0.228" "92.168.0.229" "92.168.0.208" "92.168.0.231" "92.168.0.210" "92.168.0.232" "92.168.0.223" "92.168.0.209" "92.168.0.211" "92.168.0.233" "92.168.0.215" "92.168.0.218" "92.168.0.234" "92.168.0.214" "92.168.0.226" "92.168.0.230" "92.168.0.227" "92.168.0.206" "92.168.0.240" "92.168.0.241" "92.168.0.236" "92.168.0.239" "92.168.0.237" "92.168.0.235" "92.168.0.238"38:T7ca,"my_testfile.exe" called "FindFirstFileW" with parameter C:\\* (UID: 00000000-00007824) "my_testfile.exe" called "FindFirstFileW" with parameter C:\\$Recycle.Bin\* (UID: 00000000-00007824) "my_testfile.exe" called "FindFirstFileW" with parameter C:\\$WINDOWS.~BT\* (UID: 00000000-00007824) "my_testfile.exe" called "FindFirstFileW" with parameter C:\\Config.Msi\* (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter README.HAes.txt (UID: 00000000-00007824) "my_testfile.exe" called "FindFirstFileW" with parameter C:\\found.000\* (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0000.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0001.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0002.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0003.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0004.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0005.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0006.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0007.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0008.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0009.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0010.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0011.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter dir0012.chk (UID: 00000000-00007824) "my_testfile.exe" called "FindNextFileW" with parameter file00000003.chk (UID: 00000000-00007824)39:Tf2d,Found string "README.HAes." (Indicator: "aes"; File: "screen_5.png") Found string "README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp") Found string ".HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp") Found string "HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp") Found string ":\\README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string ":\\Users\HAPUBWS\README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\$WINDOWS.~BT\Sources\replacementmanifests\README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string ":\\PerfLogs\Admin\README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string ":\\Users\Default\README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found string "??\c:\$windows.~bt\sources\replacementmanifests\readme.haes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string ":\\found.000\dir0002.chk\$filehashes$.dat.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string ":\\BOOTNXT.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\$WINDOWS.~BT\Sources\setupplatform.cfg.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\found.000\dir0002.chk\$filehashes$.dat.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\$WINDOWS.~BT\Sources\upgrade_bulk.xml.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "\??\C:\found.000\dir0001.chk\update.cat.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "\??\C:\$WINDOWS.~BT\Sources\SFPATWT.INF.HAest" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "\??\C:\$WINDOWS.~BT\Sources\nxquery.inf.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "\??\C:\found.000\dir0001.chk\update.mum.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\System Volume Information\README.HAes.txt" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\$WINDOWS.~BT\Sources\SFLISTWT.WOA.DAT.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "\??\C:\$WINDOWS.~BT\Sources\SFPAT.INF.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\found.000\dir0001.chk\update.cat.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\C:\$WINDOWS.~BT\Sources\SFPATWT.INF.HAes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found string "??\c:\$windows.~bt\sources\sfpatwt.inf.haes" (Indicator: "aes"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp")3a:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp")3b:T13d7,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "my_testfile") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "my_testfile") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "my_testfile") Found reference to API "11539039503,2712,3118,,FindNextFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11403474790,2712,3118,,FindNextFileW,kernel32.dll,"00:37:20.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11542467720,6544,3116,,FindFirstFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11438473015,6544,3118,,FindNextFileW,kernel32.dll,"00:37:20.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11513765470,2712,3118,,FindNextFileW,kernel32.dll,"00:37:20.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11433271466,2712,3116,,FindFirstFileW,kernel32.dll,"00:37:20.140",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11538651113,2712,3118,,FindNextFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11543244090,6544,3118,,FindNextFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11542891334,6544,3118,,FindNextFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11543349258,6544,3118,,FindNextFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11538174287,2712,3116,,FindFirstFileW,kernel32.dll,"00:37:20.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11392256583,6544,3118,,FindNextFileW,kernel32.dll,"00:37:20.125",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11438208981,6544,3118,,FindNextFileW,kernel32.dll,"00:37:20.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "11513600914,2712,3118,,FindNextFileW,kernel32.dll,"00:37:20.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000000.143373.032B0000.00000004.mdmp") Found reference to API "33500065009,6544,3118,,FindNextFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33498830735,2712,3118,,FindNextFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33499289599,6544,3116,,FindFirstFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33502998071,2712,3118,,FindNextFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33495125693,6544,3116,,FindFirstFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33502734651,2712,3118,,FindNextFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33502818827,2712,3118,,FindNextFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp") Found reference to API "33498922661,2712,3118,,FindNextFileW,kernel32.dll,"00:37:29.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp")3c:T7a8,Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "my_testfile") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "my_testfile") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "my_testfile") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "my_testfile") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "my_testfile") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "my_testfile") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "my_testfile") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "my_testfile") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")3d:T6e3,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "my_testfile") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "my_testfile") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "my_testfile") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; File: "my_testfile") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "my_testfile") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; File: "my_testfile") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; File: "my_testfile") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")3e:T4bd,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "my_testfile") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "my_testfile") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "my_testfile") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "my_testfile") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "my_testfile") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")3f:T737,Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; File: "my_testfile") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; File: "my_testfile") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; File: "my_testfile") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "my_testfile") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; File: "my_testfile") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "my_testfile") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; File: "my_testfile") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")40:Ta9c,"my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "my_testfile.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")41:T45d,Found string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "%s"" (Indicator: "cmd.exe /c ping"; File: "my_testfile") Found string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "%s"" (Indicator: "/c ping"; File: "my_testfile") Found string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\my_testfile.exe"" (Indicator: "cmd.exe /c ping"; Source: "00000000-00007824-00000C45-185794033011") Found string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\my_testfile.exe"" (Indicator: "/c ping"; Source: "00000000-00007824-00000C45-185794033011") Found string "ping 127.0.0.7 -n 3" (Indicator: "ping "; Source: "00000000-00005628-00000C45-1128888666") Found string "/C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\my_testfile.exe"" (Indicator: "/c ping"; File: "cmd.exe") Found string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "%s"" (Indicator: "cmd.exe /c ping"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp") Found string "cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "%s"" (Indicator: "/c ping"; Source: "00000000-00007824.00000002.147215.00401000.00000002.mdmp")42:T83a,"YOUR FILES HAVE BEEN ENCRYPTED!" (Source: my_testfile, Indicator: "files have been encrypted") "~~Mamona, R.I.P!~~Welcome!Visit our blog --> http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onionChat ---> bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u Password ---> As you may have noticed by now, all of your files were encrypted & stolen.---------------------------------------------------------------------------------[What happened?]-> We have stolen a significant amount of your important files from your network and stored them on our servers.-> Additionally, all files are encrypted, making them inaccessible without our decryption tool.[What can you do?]--> You have two options:--> 1. Pay us for the decryption tool, and:-->- You can decrypt all your files.-->- Stolen data will be deleted from our servers.-->- You will receive a report detailing how we accessed your network and security recommendations.-->- We will stop targeting your company.--> 2. Refuse to pay and:-->- Your stolen data will be published publicly.-->- Your files will remain locked.-->- Your reputation will be damaged, and you may face legal and financial consequences.-->- We may continue targeting your company.[Warnings]--> Do not alter your files in any way. If you do, the decryption tool will not work, and you will lose access permanently.--> Do not contact law enforcement. If you do, your data will be exposed immediately.--> Do not hire a recovery company. Decrypting these files without our tool is impossible. Each file is encrypted with a unique key, and you need our tool to decrypt them." (Source: README.HAes.txt, Indicator: "files are encrypted") "-> Additionally, all files are encrypted, making them inaccessible without our decryption tool." (Source: 00000000-00007824.00000000.143373.0040C000.00000004.mdmp, 00000000-00007824.00000001.145292.0040C000.00000004.mdmp, Indicator: "files are encrypted") "YOUR FILES HAVE BEEN ENCRYPTED!" (Source: 00000000-00007824.00000002.147215.00401000.00000002.mdmp, Indicator: "files have been encrypted")43:Ted4,"my_testfile.exe" opened "C:\$MAPFAILURE" with delete access "my_testfile.exe" opened "C:\bootmgr" with delete access "my_testfile.exe" opened "C:\$WINDOWS.~BT\Sources\appraiser.sdb" with delete access "my_testfile.exe" opened "C:\$WINDOWS.~BT\Sources\SFLISTWT.DAT" with delete access "my_testfile.exe" opened "C:\$WINDOWS.~BT\Sources\SFPAT.INF" with delete access "my_testfile.exe" opened "C:\$WINDOWS.~BT\Sources\SFPATWT.INF" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\$filehashes$.dat" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest" with delete access "my_testfile.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest" with delete access1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791207812572,"unified_at":"2026-10-05T13:43:32.572Z","metadata":{"hashes":{"sha256":"c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7","sha1":"15ca8d66aa1404edaa176ccd815c57effea7ed2f","md5":"0f6d6ef9b82ece9dbbdc711ac00b5e6a","sha512":"f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1","ssdeep":"3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18","ssdeep_chunks":["3072:GsrPf+o","3072:srPf+od","3072:rPf+odp","3072:Pf+odpt","3072:f+odptG","3072:+odptGM","3072:odptGM3","3072:dptGM3N","3072:ptGM3Nu","3072:tGM3Nu6","3072:GM3Nu6L","3072:M3Nu6L6","3072:3Nu6L6C","3072:Nu6L6C4","3072:u6L6C4/","3072:6L6C4/n","3072:L6C4/nF","3072:6C4/nFB","3072:C4/nFBC","3072:4/nFBCk","3072:/nFBCkA","3072:nFBCkAh","3072:FBCkAhy","3072:BCkAhyh","3072:CkAhyht","3072:kAhyhts","3072:Ahyhtsi","3072:hyhtsij","3072:yhtsijL","3072:htsijLr","3072:tsijLrl","3072:sijLrlH","3072:ijLrlH5","3072:jLrlH5A","3072:LrlH5Ae","3072:rlH5AeJ","3072:lH5AeJl","3072:H5AeJl2","3072:5AeJl2a","3072:AeJl2a/","3072:eJl2a/1","3072:Jl2a/18","3072:l2a/18O","3072:2a/18OS","6144:GsrPf+o","6144:srPf+od","6144:rPf+odp","6144:Pf+odpt","6144:f+odptG","6144:+odptGM","6144:odptGM3","6144:dptGM3N","6144:ptGM3Nu","6144:tGM3Nu6","6144:GM3Nu6L","6144:M3Nu6L6","6144:3Nu6L6C","6144:Nu6L6C4","6144:u6L6C4/","6144:6L6C4/n","6144:L6C4/nF","6144:6C4/nFB","6144:C4/nFBC","6144:4/nFBCk","6144:/nFBCkA","6144:nFBCkAh","6144:FBCkAhy","6144:BCkAhyh","6144:CkAhyht","6144:kAhyhts","6144:Ahyhtsi","6144:hyhtsij","6144:yhtsijL","6144:htsijLr","6144:tsijLrl","6144:sijLrlH","6144:ijLrlH5","6144:jLrlH5A","6144:LrlH5Ae","6144:rlH5AeJ","6144:lH5AeJl","6144:H5AeJl2","6144:5AeJl2a","6144:AeJl2a/","6144:eJl2a/1","6144:Jl2a/18","6144:l2a/18O","6144:2a/18OS","3072:GsrPWod","3072:srPWodR","3072:rPWodR6","3072:PWodR6C","3072:WodR6CI","3072:odR6CIi","3072:dR6CIik","3072:R6CIikA","3072:6CIikAh","3072:CIikAhy","3072:IikAhyD","3072:ikAhyDh","3072:kAhyDhv","3072:AhyDhvB","3072:hyDhvBS","3072:yDhvBSc","3072:DhvBSc1","3072:hvBSc18"],"imphash":"bea0fe4f47a3540e17a85006a21d644c"},"file_info":{"file_name":"0F6D6EF9B82ECE9DBBDC711AC00B5E6A.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":185856,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1742420724000,"last_seen":1743054034000,"last_multi_scan":1743054034000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["analysis"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":134,"suspicious_count":23,"malicious_count":4,"total":161},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Wacapew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Nekark.wsrzf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.37708954","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.37708954 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.OSW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wacapew.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c46791 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"ACL/Ransomware Generic.YHKG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.kwhtng","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mamona-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.DLBB-8703","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusC.HWP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve event logs (API string)"},{"type":"informative","value":"Contains ability to delete all entries from an event log (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Rename many files (often indicator of ransomware infection)"},{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"},{"type":"suspicious","value":"Drops executable files inside user directory"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"},{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Renames many files with double extensions (often indicator of ransomware infection)"},{"type":"suspicious","value":"Write many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"},{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"tactic":"Impact","technique":"Defacement","attack_id":"T1491","attack_id_wiki":"https://attack.mitre.org/techniques/T1491","identifiers":[{"type":"suspicious","value":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delete all entries from an event log (API string)","description":"Found reference to API \"ClearEventLogW\" (Indicator: \"ClearEventLog\"; File: \"my_testfile\")\n Found reference to API \"ClearEventLogW\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-211","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"my_testfile\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"my_testfile\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"my_testfile\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"my_testfile\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"my_testfile\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"my_testfile\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"my_testfile\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"my_testfile\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"my_testfile\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"my_testfile\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"my_testfile\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"my_testfile\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 26430-78-0041C668\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 26430-78-0041C668\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 26430-108-004171F5\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 26430-108-004171F5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"my_testfile\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"my_testfile\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"my_testfile.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007824)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005628)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"my_testfile\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"my_testfile\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"my_testfile.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"my_testfile.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"my_testfile\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"my_testfile\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"my_testfile\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"my_testfile\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"my_testfile\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"my_testfile.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"my_testfile\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"my_testfile\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"my_testfile\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"my_testfile.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"C:\\my_testfile.exe\"\" - (UID: 00000000-00007824)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"ping 127.0.0.7 -n 3\" - (UID: 00000000-00005628)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"my_testfile\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"my_testfile\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; File: \"my_testfile\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"my_testfile\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"my_testfile\")\n Found string \"cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"C:\\my_testfile.exe\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007824-00000C45-185794033011\")\n Found string \"cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"%s\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"my_testfile\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"my_testfile\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"my_testfile\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"my_testfile\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"my_testfile\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"my_testfile\")\n Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; File: \"my_testfile\")\n Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"my_testfile\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"my_testfile\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"my_testfile\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:7824:168:WilStaging_02\"\n \"SM0:7824:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"my_testfile\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"my_testfile.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76350000\n \"my_testfile.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72800000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76350000\n \"PING.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76350000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"my_testfile.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74230000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74230000\n \"PING.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74230000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"my_testfile\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"my_testfile\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"my_testfile\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"my_testfile.exe\" touched \"Recycle Bin Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4A04656D-52AA-49DE-8A09-CB178760E748}\\INSTANCE\")\n \"my_testfile.exe\" touched \"Copy/Move/Rename/Delete/Link Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{3AD05575-8857-4850-9277-11B85BDB8E09}\")\n \"my_testfile.exe\" touched \"Known Folder Manager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\\INPROCSERVER32\")\n \"my_testfile.exe\" touched \"Private Profile Object\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{75847177-F077-4171-BD2C-A6BB2164FBD0}\\INPROCSERVER32\")\n \"my_testfile.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"my_testfile.exe\" touched \"Recycle Bin\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DEFAULTICON\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"my_testfile\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"my_testfile\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"my_testfile\" has an writable section named \".data\"\n \"my_testfile\" has an writable section named \".fptable\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"my_testfile\" file has an entrypoint instructions - \"call\t0x40d39b,jmp\t0x40cf33,push\tebp,mov\tebp, esp,sub\tesp, 0xc,lea\tecx, [ebp - 0xc],call\t0x40c8c7,push\t0x429f84,lea\teax, [ebp - 0xc],push\teax,call\t0x40db34,int3\t,push\tebp,mov\tebp, esp,sub\tesp, 0xc,lea\tecx, [ebp - 0xc],call\t0x4011c0,push\t0x429e2c,lea\teax, [ebp - 0xc],push\teax,call\t0x40db34,int3\t,jmp\t0x414240,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],push\tesi,mov\tecx, dword ptr [eax + 0x3c],add\tecx, eax,movzx\teax, word ptr [ecx + 0x14],lea\tedx, [ecx + 0x18],add\tedx, eax,movzx\teax, word ptr [ecx + 6],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"MpCmdRun.exe\" (Indicator: \"mpcmdrun.exe\") in Source: my_testfile\n \"MSASCui.exe\" (Indicator: \"msascui.exe\") in Source: my_testfile","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00005628) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00005628) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"PING.EXE\" (UID: 00000000-00006308) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"C:\\\\my_testfile.exe\"\" (UID: 00000000-00005628)\n Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.7 -n 3\" (UID: 00000000-00006308)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"C:\\\\my_testfile.exe\"\" (UID: 00000000-00005628)\n Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.7 -n 3\" (UID: 00000000-00006308)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"my_testfile\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"my_testfile\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"my_testfile\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"my_testfile.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$31","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"my_testfile.exe\" queries basic process information of the \"C:\\my_testfile.exe\" (UID: 7824)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"my_testfile.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"my_testfile.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"my_testfile.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"my_testfile.exe\" trying to access non-existent file \"C:\\cmd.exe\"\n \"my_testfile.exe\" trying to access non-existent file \"cmd.exe\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"my_testfile.exe\" trying to access non-existent file \"Z:\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$36","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"my_testfile.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.DAT.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\found.000\\dir0001.chk\\$filehashes$.dat.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\bootTel.dat.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFCN.DAT.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFLCID.DAT.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFLISTRS1.DAT.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.WOA.DAT.HAes\"\n \"my_testfile.exe\" writes a file \"C:\\found.000\\dir0002.chk\\$filehashes$.dat.HAes\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.7 -n 3\" (UID: 00000000-00006308)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"Visit our blog --> http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion\" (Indicator: \".onion\") in Source: 00000000-00007824.00000000.143373.0040C000.00000004.mdmp\n 00000000-00007824.00000001.145292.0040C000.00000004.mdmp\n \"Chat ---> bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u\" (Indicator: \".onion\") in Source: 00000000-00007824.00000000.143373.0040C000.00000004.mdmp\n 00000000-00007824.00000001.145292.0040C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"my_testfile\")\n Found reference to API \"WSAStartup failed\" (Indicator: \"WSAStartup\"; File: \"my_testfile\")\n Found reference to API \"WSAStartup failed\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"my_testfile\")\n Found reference to API \"WSAStartup failed\" (Indicator: \"WSAStartup\"; File: \"my_testfile\")\n Found reference to API \"WSAStartup failed\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"my_testfile\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"my_testfile\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; File: \"my_testfile\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"my_testfile\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"windows.~bt\\sources\\reagent.admx.haes\" [Source: 00000000-00007824.00000001.145292.032B0000.00000004.mdmp\n 00000000-00007824.00000002.147215.032B0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onionchat\"\n Pattern match: \"http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion\"\n Heuristic match: \":\\\\found.000\\dir0001.chk\\update.cat\"\n Heuristic match: \"??\\c:\\found.000\\dir0001.chk\\update.cat\"\n Heuristic match: \":\\\\found.000\\dir0001.ch\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"tp.cu\"\n Heuristic match: \"ke.md\"\n Heuristic match: \":\\users\\hapubws\\ntuser.dat{47a6a17a-a514-11e7-a94e-ec0d9a05c860}.tmcontainer00000000000000000002.re\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onionchat\" - Source: \"00000000-00007824.00000000.143373.0040C000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007824.00000000.143373.032B0000.00000004.mdmp\")\n Found URL \"http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onionchat\" - Source: \"00000000-00007824.00000001.145292.0040C000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: my_testfile]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"my_testfile\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to change the configuration parameters of a service\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"my_testfile.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"my_testfile.exe\" called \"GetComputerNameW\" (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"my_testfile.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"my_testfile\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"my_testfile\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"my_testfile\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"my_testfile\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"my_testfile\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"my_testfile\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"my_testfile\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; File: \"my_testfile\")\n Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"my_testfile\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"my_testfile\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"my_testfile\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"my_testfile\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"my_testfile\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"my_testfile\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"my_testfile\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"my_testfile\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"my_testfile\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"C:\\\\Users\\%OSUSER%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007824-00000C2C-30103957328\")\n Found string \":\\\\Users\\HAPUBWS\\Documents\\Outlook Files\\README.HAes.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp\")\n Found string \":\\\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook1.pst.HAes\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password OK\" (Indicator: \"password\"; File: \"my_testfile\")\n Found string \"Warning: Both password and hash provided. Hash will be used first, then password.\" (Indicator: \"password\"; File: \"my_testfile\")\n Found string \"hash auth failed, trying password auth\" (Indicator: \"password\"; File: \"my_testfile\")\n Found string \"password OK\" (Indicator: \"password\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found string \"Warning: Both password and hash provided. Hash will be used first, then password.\" (Indicator: \"password\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found string \"hash auth failed, trying password auth\" (Indicator: \"password\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"my_testfile\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"my_testfile\")\n Found string \"NtOpenProcess\" (Indicator: \"OpenProcess\"; File: \"my_testfile\")\n Found string \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007824.00000000.143373.032B0000.00000004.mdmp, 00000000-00007824.00000001.145292.032B0000.00000004.mdmp, 00000000-00007824.00000002.147215.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"my_testfile\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"my_testfile\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"my_testfile\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"my_testfile\")\n Found reference to API \"NtTerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"my_testfile\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"my_testfile\")\n Found reference to API \"NtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"my_testfile\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"DuplicateToken\" which can \"Creates a new access token that duplicates one already in existence\" [Source: my_testfile]\n Observed import api \"DuplicateTokenEx\" which can \"Creates a new access token that duplicates an existing token\" [Source: my_testfile]\n Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: my_testfile]\n Observed import api \"ImpersonateLoggedOnUser\" which can \"Lets the calling thread impersonate the security context of a logged-on user\" [Source: my_testfile]\n Observed import api \"RevertToSelf\" which can \"Terminates the impersonation of a client application\" [Source: my_testfile]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"my_testfile\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"my_testfile\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"my_testfile.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"my_testfile\" has section name .text with entropy \"6.643472935108763\"\n \"my_testfile\" has section name .reloc with entropy \"6.494085572888106\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"my_testfile.exe\" (Thread ID: 4820) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"my_testfile.exe\" reads file \"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"syncres.dll.mui.HAes\" has type \"DOS executable (COM)\"- Location: [C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba\\syncres.dll.mui.HAes]- [targetUID: 00000000-00007824]\n \"memtest.efi.mui.HAes\" has type \"DOS executable (COM)\"- Location: [C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_e58afb6c453b77e6\\memtest.efi.mui.HAes]- [targetUID: 00000000-00007824]\n \"amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes\" has type \"DOS executable (COM)\"- Location: [C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes]- [targetUID: 00000000-00007824]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"my_testfile.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"2\"}","origin":"API Call","mitre_attack_id":"T1016","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"$41","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"my_testfile.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"%USERPROFILE%\\wallpaper.bmp\")","origin":"Registry Access","mitre_attack_id":"T1491","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$42","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 639 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"my_testfile.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"511\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"my_testfile.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"511\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"my_testfile.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007824)\n \"my_testfile.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.7 -n 3\" (UID: 00000000-00006308)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"%s\"\" (Indicator: \"ping\"; File: \"my_testfile\")\n Found string \"/C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"C:\\my_testfile.exe\"\" (Indicator: \"ping\"; File: \"cmd.exe\")\n Found string \"cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q \"%s\"\" (Indicator: \"ping\"; Source: \"00000000-00007824.00000002.147215.00401000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$43","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"my_testfile.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"my_testfile.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"%USERPROFILE%\\wallpaper.bmp\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes\" has type \"DOS executable (COM)\"- Location: [C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes]- [targetUID: 00000000-00007824]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"StartServiceW\n OpenProcessToken\n IcmpSendEcho\n LoadLibraryW\n Sleep\n CreateFileW\n FindFirstFileExW\n GetDriveTypeW\n CreateToolhelp32Snapshot\n FindNextFileW\n VirtualProtect\n WriteFile\n OpenProcess\n FindFirstFileW\n GetModuleHandleExW\n GetModuleHandleW\n GetCommandLineA\n GetFileSizeEx\n GetNativeSystemInfo\n GetProcAddress\n GetCommandLineW\n LoadLibraryExW\n Process32NextW\n TerminateProcess\n GetTickCount64\n GetComputerNameExW\n GetComputerNameW\n GetModuleFileNameW\n Process32FirstW\n IsDebuggerPresent\n UnhandledExceptionFilter\n CreateProcessW\n GetStartupInfoW\n GetFileAttributesW\n NetShareEnum\n EnumPrintersW\n WSAStartup","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"my_testfile\" has a section named \".fptable\"\n \"my_testfile\" has a section named \".config\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Rename many files (often indicator of ransomware infection)","description":"\"my_testfile.exe\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"my_testfile.exe\" write more than 100 files with extension \"..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest.HAes\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 404)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\") in Source: my_testfile\n \"mpssvc\" (Indicator: \"mpssvc\") in Source: my_testfile","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames many files with double extensions (often indicator of ransomware infection)","description":"\"my_testfile.exe\" renames more than 100 files with extension \"..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_63a0cd14c041be14.manifest.HAes\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 001\" in Source: 00000000-00006648.00000000.119693.00750000.00000004.mdmp\n 00000000-00006648.00000001.121615.00750000.00000004.mdmp\n 00000000-00006648.00000002.123532.00750000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\" Nul & Del /f /q \"C:\\my_testfile.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007824","uid":"00000000-00005628"},{"pid":6308,"ppid":5628,"name":"PING.EXE","command_line":"ping 127.0.0.7 -n 3","sha256":"c9b49dbf091bc66d6aee677269c613aeda0952ddbd113e21a6d9553c3e374d0f","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00000000-00005628","uid":"00000000-00006308"}],"all_imported_dlls":["cryptsp.dll","shell32.dll","windows.storage.dll","uxtheme.dll","clbcatq.dll","rsaenh.dll","wow64win.dll","rpcrt4.dll","gdi32.dll","gdi32full.dll","IPHLPAPI.DLL","ntmarta.dll","WSHTCPIP.DLL","user32.dll","wow64cpu.dll","mpr.dll","combase.dll","SHCore.dll","shlwapi.dll","dhcpcsvc6.dll","dhcpcsvc.dll","apphelp.dll","VxSSL32.dll","samcli.dll","kernel.appcore.dll","nsi.dll","wshqos.dll","wship6.dll","bcryptprimitives.dll","win32u.dll","ucrtbase.dll","srvcli.dll","profapi.dll","propsys.dll","ntdll.dll","wow64.dll","KernelBase.dll","bcrypt.dll","oleaut32.dll","powrprof.dll","winnsi.dll","mswsock.dll","advapi32.dll","msvcrt.dll","cryptbase.dll","imm32.dll","sechost.dll","sspicli.dll","msvcp_win.dll","ws2_32.dll","netapi32.dll","netutils.dll","ole32.dll","cfgmgr32.dll","kernel32.dll","fltLib.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"syncres.dll.mui.HAes","sha256":"0980ebefd91d45dd43c89da18c3a534b8ddab604a10da282e5d9af4d90bdcd47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"name":"README.HAes.txt","sha256":"c192767affe9bd9c625773ef08017a988057b996c6335a91860a9fd283adb8e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"name":"amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes","sha256":"bfcfe8a980d9fc8a29fe36bb4ee837fd38ae5f0396bccf7385455e512c97aefc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"name":"memtest.efi.mui.HAes","sha256":"ce618c1cc70b0bd7eae76d2bf1113ea1342279e1b3f1540a2bcfb6b1dd723c74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"name":"MicrosoftEdgeFavoritesBackup.html.HAes","sha256":"97e46dab8851ecdb91debadbfd47b80c36688d5824b299e8fdf70720fc942d94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"name":"oobe-progress-template.html.HAes","sha256":"a600646aa970a87d49e30b712eef230f172d7ed3bb9a86c111ef5e6366211f8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$Recycle.Bin\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$MAPFAILURE.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\BOOTNXT.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\bootTel.dat.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\Config.Msi\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\MSOCache\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\PerfLogs\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\Recovery\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\tempdir\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\System Volume Information\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\TorService\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\Users\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-18\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0000.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0003.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0004.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0005.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0006.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0007.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0008.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0009.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0010.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0011.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0012.chk\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\file00000003.chk.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\PerfLogs\\Admin\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\TorService\\data\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\TorService\\tor\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"%USERPROFILE%\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"%PUBLIC%\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\hwcompat.txt.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\hwexclude.txt.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\nxquery.inf.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.admx.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.xml.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupplatform.cfg.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFCN.DAT.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLCID.DAT.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\appraiser.sdb.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTRS1.DAT.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.DAT.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.WOA.DAT.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPAT.INF.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPATRS1.INF.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\uninstall.xml.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPATWT.INF.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\upgrade_bulk.xml.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\$filehashes$.dat.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_basicdisplay.inf_31bf3856ad364e35_10.0.17134.1_none_15a0a24ecefe2c08\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_basicrender.inf_31bf3856ad364e35_10.0.17134.1_none_d2a4d453fc2ccf14\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_bthleenum.inf_31bf3856ad364e35_10.0.17134.1_none_9c8f8ab2e226b32e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_bthpan.inf_31bf3856ad364e35_10.0.17134.1_none_03fc23c4b916f8c3\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_bthprint.inf_31bf3856ad364e35_10.0.17134.1_none_e35b5f7602624c2d\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_buttonconverter.inf_31bf3856ad364e35_10.0.17134.1_none_7c47985213344f20\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_barcodescanner.inf_31bf3856ad364e35_10.0.17134.1_none_42fc83d78749326c\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_cashdrawer.inf_31bf3856ad364e35_10.0.17134.1_none_89197834e9647294\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_linedisplay.inf_31bf3856ad364e35_10.0.17134.1_none_ad4727a8c2f25294\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_magneticstripereader.inf_31bf3856ad364e35_10.0.17134.1_none_8ed26c3e962592c8\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_receiptprinter.inf_31bf3856ad364e35_10.0.17134.1_none_c32532b5ff00a6b6\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_display.inf_31bf3856ad364e35_10.0.17134.1_none_81e50fd40e84e47e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_fusionv2.inf_31bf3856ad364e35_10.0.17134.1_none_a2c130515c53981a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_hidbth.inf_31bf3856ad364e35_10.0.17134.1_none_29e1aeb7310c42dd\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..licymanagerbrokerps_31bf3856ad364e35_10.0.17134.1_none_5e9328a4938e27b9\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..licymanagerbrokerps_31bf3856ad364e35_10.0.17134.1_none_5e9328a4938e27b9.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_1b018b35f5ddad2e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_1b018b35f5ddad2e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_hidbthle.inf_31bf3856ad364e35_10.0.17134.1_none_10c33264dc0d30f2\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_hidinterrupt.inf_31bf3856ad364e35_10.0.17134.1_none_3c0d30c6df4b4ed4\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_hidvhf.inf_31bf3856ad364e35_10.0.17134.1_none_5f058f010856977f\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_idtsec.inf_31bf3856ad364e35_10.0.17134.1_none_d87a7ed99540aa4c\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_input.inf_31bf3856ad364e35_10.0.17134.1_none_0e49b2d953183e02.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_mausbhost.inf_31bf3856ad364e35_10.0.17134.1_none_9f648b79c0f9f1c2\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_mausbhost.inf_31bf3856ad364e35_10.0.17134.1_none_9f648b79c0f9f1c2.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_mgtdyn.inf_31bf3856ad364e35_10.0.17134.1_none_cc195941b32e5da3\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_miradisp.inf_31bf3856ad364e35_10.0.17134.1_none_c7e53ad6db9f67a9\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_msgpiowin32.inf_31bf3856ad364e35_10.0.17134.1_none_5d85f18cc988b876\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_msmouse.inf_31bf3856ad364e35_10.0.17134.1_none_c9127cd775ef8879\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_ndisuio.inf_31bf3856ad364e35_10.0.17134.1_none_2456c3b1a5c2bb85\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_netnb.inf_31bf3856ad364e35_10.0.17134.1_none_ebe638c258506507\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_netpacer.inf_31bf3856ad364e35_10.0.17134.1_none_de3c2afd6d94b6a4\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_npsvctrig.inf_31bf3856ad364e35_10.0.17134.1_none_6644ccbe543a52ca\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_ace0eed0fc56496f\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_ace0eed0fc56496f.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.17134.1_none_151a1b146da49afd\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.17134.1_none_151a1b146da49afd.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_oposdrv.inf_31bf3856ad364e35_10.0.17134.1_none_a6cfc14d838321bf\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_remoteposdrv.inf_31bf3856ad364e35_10.0.17134.1_none_b779d2c5bc589c4c.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_sensorshidclassdriver.inf_31bf3856ad364e35_10.0.17134.1_none_92a1cf19f639f90a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_ufxchipidea.inf_31bf3856ad364e35_10.0.17134.1_none_f5c834ebc9ce7654\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_ufxchipidea.inf_31bf3856ad364e35_10.0.17134.1_none_f5c834ebc9ce7654.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_urschipidea.inf_31bf3856ad364e35_10.0.17134.1_none_f4ca567c7d57687b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_urssynopsys.inf_31bf3856ad364e35_10.0.17134.1_none_f1eb87334130843e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_usbcciddriver.inf_31bf3856ad364e35_10.0.17134.1_none_4070b1e28eb5028d\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_usbser.inf_31bf3856ad364e35_10.0.17134.1_none_8281fb62ec80df7e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_usbstor.inf_31bf3856ad364e35_10.0.17134.1_none_264b44d815dcdf50\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_vdrvroot.inf_31bf3856ad364e35_10.0.17134.1_none_a18506d29a6abad8\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_vhdmp.inf_31bf3856ad364e35_10.0.17134.1_none_7450d89762bf67bb\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_wdma_bt.inf_31bf3856ad364e35_10.0.17134.1_none_7fed5e7ceaf6f330\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_winusb.inf_31bf3856ad364e35_10.0.17134.1_none_ab761f239f1f9a3a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_xboxgip.inf_31bf3856ad364e35_10.0.17134.1_none_517c1368f133f239\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_xusb22.inf_31bf3856ad364e35_10.0.17134.1_none_366b06beaad86d64\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_fdphost_31bf3856ad364e35_10.0.17134.1_none_6118d041d796ba47\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_fdrespub_31bf3856ad364e35_10.0.17134.1_none_64f4cd14279775ae\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_fdssdp_31bf3856ad364e35_10.0.17134.1_none_205e7eeedd68c74b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\$filehashes$.dat.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_fdwnet_31bf3856ad364e35_10.0.17134.1_none_20a9397cdd3c20cd\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-appmodel-exec-events_31bf3856ad364e35_10.0.17134.1_none_07677813525018a6\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_hyperv-storage-vhd-vhdmp_31bf3856ad364e35_10.0.17134.1_none_a1299a9bbf5c92d8.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.17134.1_none_f80e1506497cdc7d\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-client-li..platform-pkeyhelper_31bf3856ad364e35_10.0.17134.1_none_80fc199340598eb9.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-c..experiencehost-user_31bf3856ad364e35_10.0.17134.1_none_a28304f2bb473593\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-c..ess-policy-location_31bf3856ad364e35_10.0.17134.1_none_4e03be01da60372d.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-c..llmanageretw-events_31bf3856ad364e35_10.0.17134.1_none_686962f394b8c021\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-h..df-class-extensions_31bf3856ad364e35_10.0.17134.1_none_e8545a16fe886349\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.17134.1_none_cd3cc4edfdce8feb\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_085c9ad7af984bcf\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-m..imedia-broadcastdvr_31bf3856ad364e35_10.0.17134.1_none_74f31bcd14bf0f8d.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-xamltilerender_31bf3856ad364e35_10.0.17134.1_none_4262b18fcf58db28\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-n..anager-capabilities_31bf3856ad364e35_10.0.17134.1_none_59895a4a261eccdb.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-pdc-events-container_31bf3856ad364e35_10.0.17134.1_none_ae39b05c16946df3\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..-service.deployment_31bf3856ad364e35_10.0.17134.1_none_31aa169db67ac3fe\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_10.0.17134.1_none_f1a5c55f5b741dbc\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.17134.1_none_b03bac357662eb62\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_10.0.17134.1_none_f1a6c5a95b733713\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..esolverux.appxsetup_31bf3856ad364e35_10.0.17134.1_none_a11030fd77b5bc84\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_10.0.17134.1_none_f1a5c55f5b741dbc.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..mitigations-acwinrt_31bf3856ad364e35_10.0.17134.1_none_161e3cd7e9935971\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..on-authui-component_31bf3856ad364e35_10.0.17134.1_none_c257d73d79021ff3\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.17134.1_none_c5a3778bfdbfc860\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.17134.1_none_c8ba5d8766b6100f.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-aerolite_31bf3856ad364e35_10.0.17134.1_none_bc01bd81d1468e95\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-aero_31bf3856ad364e35_10.0.17134.1_none_91639de28293fc33.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.17134.1_none_3ccc9ca31b51b1f0\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-apprep_31bf3856ad364e35_10.0.17134.1_none_f179b7188fea9ad4\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.17134.1_none_f146c4d490108c2f\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-applicationmodel-voip_31bf3856ad364e35_10.0.17134.1_none_b4bbddcf5788cc9a.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-appx-modules_31bf3856ad364e35_10.0.17134.1_none_dd4e640c89a13479\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.17134.1_none_736718a63a4836c7.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-audio-mci_31bf3856ad364e35_10.0.17134.1_none_028de57d556265b6\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.17134.1_none_065567e662f2c6ec\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.17134.1_none_cb74c93528587dc2\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.17134.1_none_bc85db3cda17b041\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostres_31bf3856ad364e35_10.0.17134.1_none_b8e036b8f18490ec\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostres_31bf3856ad364e35_10.0.17134.1_none_b8e036b8f18490ec.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.17134.1_none_3abe8fc5b712e80b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_085c9ad7af984bcf.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-davsyncprovider_31bf3856ad364e35_10.0.17134.1_none_bbbcf5b2b22aac5e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.17134.1_none_3abe8fc5b712e80b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_db8c1c8a8d44988e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-davsyncprovider_31bf3856ad364e35_10.0.17134.1_none_bbbcf5b2b22aac5e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_db8c1c8a8d44988e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-inprocloggersetup_31bf3856ad364e35_10.0.17134.1_none_88d720ce10d25069.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-inproclogger_31bf3856ad364e35_10.0.17134.1_none_47a493bc110bfc38\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.17134.1_none_e0ae355aa7085a45\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmail_31bf3856ad364e35_10.0.17134.1_none_2d05acef046f159b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.17134.1_none_e0ae355aa7085a45.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-mccspal_31bf3856ad364e35_10.0.17134.1_none_f0e019df45dab478\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_a0fa210c520b753b\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmail_31bf3856ad364e35_10.0.17134.1_none_2d05acef046f159b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-standard-config_31bf3856ad364e35_10.0.17134.1_none_d914b9c2a964ff65.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_a0fa210c520b753b.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_034ee57d81775b52\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_d607dcf5dc927baa\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_034ee57d81775b52.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_d607dcf5dc927baa.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_7d7c85c6592f59a5\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ar-sa_74d82ed05ec3f623\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_7d7c85c6592f59a5.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_d733cdc5d64dd9f8\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_d733cdc5d64dd9f8.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_eu-es_092d8f5c23fda98a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_a85e33e1190763d2\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ga-ie_4a0c963a0c7bdc4a\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_efa1a927d84240b2\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.17134.1_none_2a13a81c175d12ec\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.17134.1_none_6e9cb6c392dc13a2\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.17134.1_none_4eb92381f5f50403\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_5913985c0d3c1fe1\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_da-dk_f64d788303821be0\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_es-es_9c35409bf45d6de4\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_es-es_9c35409bf45d6de4.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_3b504548e977600e.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_865d36e2cb8f5362\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_it-it_2914ace1be6169c4\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_865d36e2cb8f5362.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_6ea408a3a3ed42b5\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_it-it_2914ace1be6169c4.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_6ea408a3a3ed42b5.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_5575d5167d3e7846\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_nb-no_573689d87c126e71.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_pt-br_9e061a3c60ea79de\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_5575d5167d3e7846.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_9ee7e9a86059e9ba\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_e58afb6c453b77e6\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_e58afb6c453b77e6.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_210235d86b1cf7fb\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_da-dk_be3c15ff6162f3fa\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_210235d86b1cf7fb.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_de-de_bb67ab3b63394894\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_de-de_bb67ab3b63394894.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_el-gr_63fdd8ce524eb122\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_el-gr_63fdd8ce524eb122.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_en-gb_5ccfc61656eea094.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_en-us_6458813452175459.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-es_6423de18523e45fe\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-es_6423de18523e45fe.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_es-mx_665acbbe50d229a9.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_ff519e6149e8c286\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_033ee2c547583828.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_ff519e6149e8c286.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_06db541745105c60.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_4d17ae992a32ca14\\README.HAes.txt","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.17134.1_hr-hr_4d17ae992a32ca14.manifest.HAes","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\BITBUCKET\\VOLUME\\{815EAD30-0000-0000-0000-501F00000000}\\","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"},{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"name":"SM0:7824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e4e4d1df9893aff0069911"}]},{"name":"Local\\SM0:6648:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]},{"name":"SM0:6648:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e0fdf4007abaad500f566f"}]}]}},"report_ids":{"sandbox_job_ids":["67e4e4d1df9893aff0069911","67e0fdf4007abaad500f566f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c5f49c0f566a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c5f49c0f566a…. Malware family: Trojan.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c5f49c0f566a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c5f49c0f566a…. Malware family: Trojan.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c5f49c0f566a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c5f49c0f566a…. Malware family: Trojan.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]