26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Packed.7zip Sample c70a6bb61af3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c70a6bb61af3…. Malware family: Packed.7zip. Threat score 100/100. 13/24 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","keywords":["Malicious","Packed.7zip","malware analysis","sandbox report","threat intelligence","c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754"],"about":{"@type":"SoftwareApplication","name":"217e41f2c5181545ca18b7f2a3a2c1f3.exe","applicationCategory":["peexe","executable","compressed","sfx","7zip"],"identifier":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Packed.7zip","antivirusDetections":{"malicious":13,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T421f,Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "DrawIconEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "CopyImage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetInformationJobObject"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentObject"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadReadPtr"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowDC"; Source: "sample.bin"), Found reference to API (Indicator: "SuspendThread"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateJobObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceExA"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStretchBltMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "BringWindowToTop"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "ClientToScreen"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "PtInRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassNameA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")28:T554,"cmd.exe" called "LoadResource with parameter {'hModule': '4259841', 'hResInfo': '4260752'}" (UID: 00000000-00005804) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529240'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529016'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529272'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529080'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529256'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529064'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529032'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529288'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '655360', 'hResInfo': '1529048'}" (UID: 00000000-00005128) "Hardcover.pif" called "LoadResource with parameter {'hModule': '1908736000', 'hResInfo': '1908912648'}" (UID: 00000000-00005128)29:T6a7,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=" (Indicator: "SHA384"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") file/memory contains long string with (Indicator: "SHA384"; File: "Process") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00003772.00000EBC.43940407.00190000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00003772.00000EBC.43940407.00190000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00003772.00000EBC.43940407.00190000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003772.00000EBC.43940407.00190000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003772.00000EBC.43940407.00190000.wprm") Found reference to "AesF" (Indicator: "Aes"; Source: "00000000-00005128.00000002.84502.0229E000.00000004.mdmp")2a:T4dd,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\PROPERTYBAG") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PROPERTYBAG") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1")2b:Taee,Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-89-28021BDC Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-89-28021BDC Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-407-2801EF4F Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-407-2801EF4F Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-989-28023363 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-989-28023363 Assembly shows XOR instruction xor eax edx in Stream UID: 58414-1151-280093F1 Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-1565-2801EB61 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-1565-2801EB61 Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-1607-2801DABF Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-1607-2801DABF Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-1609-2801D966 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-1609-2801D966 Assembly shows XOR instruction xor eax ebp in Stream UID: 58414-1610-2801D9BC Assembly shows XOR instruction xor ecx ebp in Stream UID: 58414-1610-2801D9BC Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 58414-1648-28023EF3 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 58414-1648-28023EF3 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 58414-1648-28023EF3 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 58414-1648-28023EF3 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00003772-64910-1-001C01EE Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00003772-64910-1-001C01EE Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00003772-64910-1-001C01EE Assembly shows XOR instruction xor al 1Fh in Stream UID: 00000000-00003772-64910-621-001D60F7 Assembly shows XOR instruction xor al 1Eh in Stream UID: 00000000-00003772-64910-621-001D60F7 Assembly shows XOR instruction xor byte ptr [esi] cl in Stream UID: 00000000-00003772-64910-621-001D60F7 Assembly shows XOR instruction xor byte ptr [edi] cl in Stream UID: 00000000-00003772-64910-621-001D60F7 Assembly shows XOR instruction xor byte ptr [edi] al in Stream UID: 00000000-00003772-64910-621-001D60F7 Assembly shows XOR instruction xor byte ptr [eax] ch in Stream UID: 00000000-00003772-64910-1648-001BF848 Assembly shows XOR instruction xor al 5Bh in Stream UID: 00000000-00003772-64910-1648-001BF848 Assembly shows XOR instruction xor esp ebx in Stream UID: 00000000-00003772-64910-1648-001BF848 Assembly shows XOR instruction xor ch byte ptr [ebp-39h] in Stream UID: 00000000-00003772-64910-1648-001BF8482c:T1708,Found XOR loop in file "Hardcover.pif" at offset 147203; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 147215; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 396216; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 397854; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 693274; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 918289; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 921415; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 925385; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 927249; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 932581; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 933733; code bytes = 30d0 Found XOR loop in file "Hardcover.pif" at offset 131638; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 140891; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 141020; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 269665; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 465542; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 465617; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 599004; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 703994; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 711333; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 711781; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 712357; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 712805; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 911763; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 922983; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 924879; code bytes = 33c1 Found XOR loop in file "Hardcover.pif" at offset 633569; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 676788; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 689146; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 912626; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 920824; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 930024; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 933694; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 938868; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 941154; code bytes = 8030 Found XOR loop in file "Hardcover.pif" at offset 941317; code bytes = 8030 Found XOR loop in file "jsc.exe" at offset 8362; code bytes = 30d0 Found XOR loop in file "Power" at offset 147203; code bytes = 30d0 Found XOR loop in file "Power" at offset 147215; code bytes = 30d0 Found XOR loop in file "Power" at offset 131638; code bytes = 33c1 Found XOR loop in file "Power" at offset 140891; code bytes = 33c1 Found XOR loop in file "Power" at offset 141020; code bytes = 33c1 Found XOR loop in file "DISMHOST.EXE.6AA0B002.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AA0B002.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA0B002.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA0B002.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 271051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 314734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 341802; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 387524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 730642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 748723; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 75730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 92524; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 92653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 104904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 318758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 428544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 482401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 486675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 497893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 569140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 696756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 825614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 359332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 369683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 423652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 432473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 452224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 458138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 609389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 626465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 670466; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 709359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 809969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 952468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 955301; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958403; code bytes = 80302d:T271d,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006e77110000009401270000002700800000001d0046001a004a00180000002d42006fb070270001000000080000001b0048001800000038ec2a00a06d2700b070270050a12b0008000000000027000000000038ec2a00a06d2700b46e270060a12b0030712700ff2b6777200000009cfe12008ac4012838402b00f83f2b0011000000170000000000000094fe120011d6012860280328d0fe12005ac30128020000004ac30128992ded5c11000000e05302281700000000000000a4fe12000000000078ff120090930128291dfd74feffffff4ac3012874c60128ecfe1200e4fe1200 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000d4f712000000000078ff1200 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e4550170e4550138e6550192e0276a2a7ad536feffffffb8e5550116bc266ac477d0ca01000000ece45501b8e5550120bc266a0600000000008a6a010000002fbc266a2a00000006000000c477d0ca01000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e55501000000008e00000044e65501feffffffcce55501cf006877d6006877665129768e0000004700000044e6550100000000a0e555010000000008e6550195e16377b2b21b00feffffffd60068772f7b6b750100000043000807167b6b75fdd44c5d (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600659a4a5d44de55016d825c7604942f0004010000 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000360064006400660038006100320030006300660064003700310031003600340036006400320066003600370033006500630038003500310063003700350034002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b6777ce7d2976d8eb1277ac01270000002700000000000000000018008400ff0000000000000000000000000000000000000019007f00ff0000000000000000000000b070270000000000200000000000000000000000d0bb2d00a06d2700c06e270068502f006872270000000000e0c855010000000060ca5501 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e05f3200acee55010464677738012700e0636777065a29760000000000002700e85f32006dd1bc769cdc4c5d6cae6376000000000000000068020000f8773200803027000100000000002700500127000c000000e85f3200803027000200000218000000fe4000be820000000000000000000000030000004cee5501820000007f07000000000000fe4000be02000000c075c476f877320000000000c075c47668ee5501903127000000000080302700c0ee5501ff2b67775e5a29767400000004022700000027003800720004000000000000001000000000000101cced5501 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005684) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005908) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005908) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005804) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000350098ad350093ad35000000000000000000000031000000000120d91c000000000084e61c0095e16377cad91b00feffffff435c677750596777aa000000b800000092ad350090ad3500a8da1c00e0de1c0000000000000000000000000000000000000000000000000000000000000000001c5c667760d86b75ffffffff1700000058da1c00240000000300000048df1c0074e41c00e0de1c008600000084da1c0096ed6777baad3500a06a3d7586000000a8da1c00e0de1c000000000086008800a06a3d75a8da1c00916c3d75baad3500a06a3d75a06a3d7518df1c0002020000 (UID: 00000000-00005804) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005804)2e:T517,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /k cmd < Doll & exit" - (UID: 00000000-00005684) "cmd.exe" called "CreateProcessW" with parameter "cmd" - (UID: 00000000-00005908) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa.exe"" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "cmd /c mkdir 31469" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Power + Team + Crime + Now + Process 31469\Hardcover.pif" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Guru + Retirement 31469\E" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "31469\Hardcover.pif 31469\E" - (UID: 00000000-00005804) "cmd.exe" called "CreateProcessW" with parameter "ping -n 5 localhost" - (UID: 00000000-00005804) "Hardcover.pif" called "CreateProcessW" with parameter "%TEMP%\7ZipSfx.000\31469\jsc.exe" - (UID: 00000000-00005128)2f:T182a,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005684) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\Branding\Basebrd\Basebrd.dll (UID: 00000000-00005804) "cmd.exe" called "LoadLibrary" with a parameter NTDLL.DLL (UID: 00000000-00005804) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006032) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006028) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00006028) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00006028) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00006028) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006028) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00006028) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006028) "Hardcover.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter %TEMP%\7ZipSfx.000\31469\E (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005128) "Hardcover.pif" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005128)30:T6166,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005684) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00005908) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00005804) "cmd.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005804) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00006032) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00006032) "findstr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006036) "findstr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006036) "findstr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006036) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006036) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00006028) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00006028) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004316) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006016) "Hardcover.pif" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter RtlDecompressFragment (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005128) "Hardcover.pif" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005128)31:T637,"SOFTWARE\Classes\" in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00003772.00000EBC.43940407.00190000.wprm "teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesTotalVisibleMemorySizeSoftware\Valve\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\MicrProjectManagerosoft\WindProjectManagerows NT\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11" in Source: 00003772.00000EBC.43940407.00190000.wprm "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002268.00000000.83866.00C61000.00000020.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp "\Software\Classes\CLSID\{871c5380-42a0-10h" in Source: 00000000-00005684.00000000.81012.00270000.00000004.mdmp 00000000-00005684.00000001.81585.00270000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005684.00000000.81012.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005684.00000000.81012.00270000.00000004.mdmp 00000000-00005684.00000001.81585.00270000.00000004.mdmp32:T43d,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002268.00000000.83866.00C61000.00000020.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp "\Software\Classes\CLSID\{871c5380-42a0-10h" in Source: 00000000-00005684.00000000.81012.00270000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005684.00000000.81012.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005684.00000000.81012.00270000.00000004.mdmp "\Software\Classes\CLSID\{871c5380-42a0-10h" in Source: 00000000-00005684.00000001.81585.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005684.00000001.81585.00270000.00000004.mdmp33:T1ae8,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74180000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "COMCTL32.DLL" at base 74420000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "KERNEL32.DLL" at base 76b80000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "DWMAPI.DLL" at base 73e40000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "UXTHEME.DLL" at base 74180000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "ADVAPI32.DLL" at base 764f0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76f90000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "CRYPTBASE.DLL" at base 75420000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "CLBCATQ.DLL" at base 77260000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77440000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "KERNEL32" at base 76b80000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "OLE32.DLL" at base 76f90000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "PROFAPI.DLL" at base 75530000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76610000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "SHELL32.DLL" at base 758a0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "PROPSYS.DLL" at base 742b0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "OLEAUT32.DLL" at base 773a0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "APPHELP.DLL" at base 753d0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a8a0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 742b0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "NTMARTA.DLL" at base 74990000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b80000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "SETUPAPI.DLL" at base 769e0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "RPCRT4.DLL" at base 772f0000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75830000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76630000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "SECUR32.DLL" at base 75250000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75700000 "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753d0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a1e0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76b80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753d0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77620000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 772f0000 "tasklist.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76610000 "tasklist.exe" loaded module "ADVAPI32.DLL" at base 764f0000 "tasklist.exe" loaded module "CLBCATQ.DLL" at base 77260000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b80000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d690000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 75490000 "tasklist.exe" loaded module "KERNEL32.DLL" at base 76b80000 "tasklist.exe" loaded module "CRYPTSP.DLL" at base 74f30000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74cc0000 "tasklist.exe" loaded module "CRYPTBASE.DLL" at base 75420000 "tasklist.exe" loaded module "RPCRTREMOTE.DLL" at base 754c0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6c820000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d980000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6c7f0000 "tasklist.exe" loaded module "OLEAUT32.DLL" at base 773a0000 "findstr.exe" loaded module "KERNEL32.DLL" at base 76b80000 "Hardcover.pif" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a1e0000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74180000 "Hardcover.pif" loaded module "KERNEL32.DLL" at base 76b80000 "Hardcover.pif" loaded module "DWMAPI.DLL" at base 73e40000 "Hardcover.pif" loaded module "COMCTL32.DLL" at base 74420000 "Hardcover.pif" loaded module "UXTHEME.DLL" at base 74180000 "Hardcover.pif" loaded module "IMM32.DLL" at base 76780000 "Hardcover.pif" loaded module "COMCTL32" at base 74420000 "Hardcover.pif" loaded module "SHELL32.DLL" at base 758a0000 "Hardcover.pif" loaded module "OLE32.DLL" at base 76f90000 "Hardcover.pif" loaded module "NTDLL.DLL" at base 77620000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73b30000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73460000 "Hardcover.pif" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76610000 "Hardcover.pif" loaded module "RPCRT4.DLL" at base 772f0000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73440000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ef0000 "Hardcover.pif" loaded module "DNSAPI.DLL" at base 74db0000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 73430000 "Hardcover.pif" loaded module "WS2_32.DLL" at base 75860000 "Hardcover.pif" loaded module "IPHLPAPI.DLL" at base 73880000 "Hardcover.pif" loaded module "RASADHLP.DLL" at base 71c90000 "Hardcover.pif" loaded module "USER32.DLL" at base 77190000 "Hardcover.pif" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753d0000 "Hardcover.pif" loaded module "OLEAUT32.DLL" at base 773a0000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 737f000034:T800,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" was detected as "7-Zip" and name: "Installer" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" was detected as "Microsoft Visual C/C++" and name: "Compiler" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" was detected as "7-Zip" and name: "Archive" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" was detected as "Microsoft Linker" and name: "Linker" "Hardcover.pif" was detected as "7-Zip" and name: "Installer" "Hardcover.pif" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Hardcover.pif" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Hardcover.pif" was detected as "7-Zip" and name: "Archive" "Hardcover.pif" was detected as "Microsoft Linker" and name: "Linker" "jsc.exe" was detected as "7-Zip" and name: "Installer" "jsc.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "jsc.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "jsc.exe" was detected as "7-Zip" and name: "Archive" "jsc.exe" was detected as "Microsoft Linker" and name: "Linker" "Power" was detected as "7-Zip" and name: "Installer" "Power" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Power" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Power" was detected as "7-Zip" and name: "Archive" "Power" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6AA0B002.bin" was detected as "7-Zip" and name: "Installer" "DISMHOST.EXE.6AA0B002.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AA0B002.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AA0B002.bin" was detected as "7-Zip" and name: "Archive" "DISMHOST.EXE.6AA0B002.bin" was detected as "Microsoft Linker" and name: "Linker"35:T14e0,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")36:T1f40,Process "cmd.exe" (UID: 00000000-00005908) was launched with new environment variables: "7zSfxFolder20="%WINDIR%\Fonts", 7zSfxFolder21="%APPDATA%\Microsoft\Windows\Templates", SfxFolder39="%USERPROFILE%\Pictures", SfxFolder38="C:\Program Files", SfxFolder37="%WINDIR%\system32", MyDocs="%USERPROFILE%\Documents", SfxFolder36="C:\Windows", SfxFolder35="C:\ProgramData", SfxFolder34="%LOCALAPPDATA%\Microsoft\Windows\History", SfxFolder33="%APPDATA%\Microsoft\Windows\Cookies", SfxFolder32="%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files", SfxFolder31="%USERPROFILE%\Favorites", SfxFolder30="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder28="%USERPROFILE%\AppData\Local", 7zSfxFolder29="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder26="%USERPROFILE%\AppData\Roaming", 7zSfxFolder27="%APPDATA%\Microsoft\Windows\Printer Shortcuts", 7zSfxVarSystemLanguage="1033", 7zSfxFolder24="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder25="%PUBLIC%\Desktop", 7zSfxFolder22="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu", 7zSfxFolder23="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs", SfxVarSystemLanguage="1033", SfxString10="Could not write SFX configuration.", SfxString12="Could not create folder "%s".", SfxString11="Error in line %d of configuration data:", SfxVarSystemPlatform="x86", Bizrate="/", SfxFolder48="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", SfxString18="7-Zip: CRC error.", SfxFolder47="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", SfxString17="7-Zip: Unsupported method.", SfxFolder46="%PUBLIC%\Documents", SfxFolder45="%ALLUSERSPROFILE%\Microsoft\Windows\Templates", SfxString19="7-Zip: Data error.", SfxFolder44="%PROGRAMFILES%\Common Files", SfxString14="Could not find command for "%s".", SfxFolder43="%PROGRAMFILES%\Common Files", SfxString13="Could not delete file or folder "%s".", SfxFolder42="C:\Program Files", SfxString16="Error during execution "%s".", SfxFolder41="%WINDIR%\system32", SfxString15="Could not find "setup.exe".", SfxFolder40="C:\Users\%OSUSER%", 7zSfxFolder19="%APPDATA%\Microsoft\Windows\Network Shortcuts", SfxVarCmdLine0=""C:\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe"", 7zSfxFolder16="%USERPROFILE%\Desktop", 7zSfxFolder13="%USERPROFILE%\Music", 7zSfxFolder14="%USERPROFILE%\Videos", 7zSfxFolder11="%APPDATA%\Microsoft\Windows\Start Menu", 7zSfxFolder42="C:\Program Files", 7zSfxFolder43="%PROGRAMFILES%\Common Files", 7zSfxVarCmdLine0=""C:\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe"", 7zSfxFolder40="C:\Users\%OSUSER%", 7zSfxFolder41="%WINDIR%\system32", SfxFolder19="%APPDATA%\Microsoft\Windows\Network Shortcuts", SfxFolder16="%USERPROFILE%\Desktop", SfxFolder14="%USERPROFILE%\Videos", SfxFolder13="%USERPROFILE%\Music", SfxFolder11="%APPDATA%\Microsoft\Windows\Start Menu", Flyer="<", 7zSfxFolder48="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", 7zSfxFolder46="%PUBLIC%\Documents", 7zSfxFolder47="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", 7zSfxFolder44="%PROGRAMFILES%\Common Files", 7zSfxFolder45="%ALLUSERSPROFILE%\Microsoft\Windows\Templates", 7zSfxFolder31="%USERPROFILE%\Favorites", 7zSfxFolder32="%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files", 7zSfxFolder30="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", MyDocuments="%USERPROFILE%\Documents", SfxFolder29="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", SfxFolder28="%USERPROFILE%\AppData\Local", SfxFolder27="%APPDATA%\Microsoft\Windows\Printer Shortcuts", SfxFolder26="%USERPROFILE%\AppData\Roaming", SfxFolder25="%PUBLIC%\Desktop", SfxFolder24="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", SfxFolder23="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs", SfxFolder22="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu", SfxFolder21="%APPDATA%\Microsoft\Windows\Templates", SfxFolder20="%WINDIR%\Fonts", 7zSfxFolder39="%USERPROFILE%\Pictures", 7zSfxFolder37="%WINDIR%\system32", 7zSfxFolder38="C:\Program Files", 7zSfxFolder35="C:\ProgramData", 7zSfxFolder36="C:\Windows", 7zSfxFolder33="%APPDATA%\Microsoft\Windows\Cookies", 7zSfxFolder34="%LOCALAPPDATA%\Microsoft\Windows\History", SfxString43="Insufficient physical memory.", SfxString42="Not enough free space for extracting.", SfxString45="Preparing...", SfxString44="Enter password:", Ko="m", CommonDocuments="%PUBLIC%\Documents", SfxString41=": warning", SfxString40="7z SFX: warning", UserDesktop="%USERPROFILE%\Desktop", SfxString6="Could not get SFX filename.", SfxString7="Could not open archive file "%s".", SfxString8="Non 7z archive.", SfxString9="Could not read SFX configuration or configuration not found.", USERDNSDOMAIN="%OSUSER%-PC", 7zSfxFolder53="%PUBLIC%\Music", 7zSfxFolder54="%PUBLIC%\Pictures", SfxFolder09="%APPDATA%\Microsoft\Windows\SendTo", SfxFolder08="%APPDATA%\Microsoft\Windows\Recent", SfxFolder07="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", SfxFolder06="%USERPROFILE%\Favorites", SfxFolder05="%USERPROFILE%\Documents", Olympus="x", SfxFolder02="%APPDATA%\Microsoft\Windows\Start Menu\Programs", SfxString1="SFX module - Copyright (c) 2005-2016 Oleg Scherbakov", SfxFolder00="%USERPROFILE%\Desktop", SfxString2="7z SFX", SfxString3="7z SFX: error", SfxString4=": error", 7zSfxVarModulePlatform="x86", SfxString5="Extracting", 7zSfxFolder59="%LOCALAPPDATA%\Microsoft\Windows\Burn\Burn", 7zSfxFolder55="%PUBLIC%\Videos", 7zSfxFolder56="%WINDIR%\resources", SfxString21="Extraction path", SfxString20="7-Zip: Internal error code %u.", SfxString23="Really cancel the installation?", SfxString22="Extraction path:", SfxFolder59="%LOCALAPPDATA%\Microsoft\Windows\Burn\Burn", SfxString29="s", SfxString28="No", SfxFolder56="%WINDIR%\resources", SfxFolder55="%PUBLIC%\Videos", SfxString25="OK", SfxFolder54="%PUBLIC%\Pictures", SfxString24="No "HelpText" in the configuration file.", SfxFolder53="%PUBLIC%\Music", SfxString27="Yes", SfxString26="Cancel", 7zSfxFolder08="%APPDATA%\Microsoft\Windows\Recent", 7zSfxFolder09="%APPDATA%\Microsoft\Windows\SendTo", 7zSfxFolder06="%USERPROFILE%\Favorites", 7zSfxFolder07="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder05="%USERPROFILE%\Documents", 7zSfxFolder02="%APPDATA%\Microsoft\Windows\Start Menu\Programs", 7zSfxFolder00="%USERPROFILE%\Desktop", SfxString32="Error in command line:", SfxString31="Could not overwrite file "%s".", SfxString34="7-Zip: Extraction error.", SfxString33="7-Zip: Internal error code 0x%08X.", 7zSfxVarSystemPlatform="x86", SfxString30="Could not create file "%s".", SfxVarModulePlatform="x86", SfxString36="Next", SfxString35="Back", SfxString38="Cancel", SfxString37="Finish", Total="d", CommonDesktop="%PUBLIC%\Desktop"" Process "cmd.exe" (UID: 00000000-00005908) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00005804) was launched with new environment variables: "PROMPT="$P$G"" Process "tasklist.exe" (UID: 00000000-00006032) was launched with new environment variables: "aTtXKEwaHCRGEximlQwIrHGOTpmQLaazTn="v", mWpXnvUvuuNAjLuwhceFuVkoizfeAQZQGoJsN="d", fxVHMEfqMeoaFnfGdJFdHMBYtfBQpqFFRk="a", kalvGycdchjYeSoMNoVhcVeOMTkoTHdUggMhUKElOBt="l", PLPZtxJQtDgxTOlVucDYODxsqQmNgkRAooWHgiYzPIToB="e", FjvYgSoNteIhSgpWvwdXvfSbiPFgeVDznEC="h", lkiXZueHrSOcUyDgncqxVveuKcYjNmvaHRpjQU="c", wXhKUVUIgACgyxkIPBzvFaluJHvxhBReGdpeYVJlVhXhcEly="g", JvbQpLvCdnUbBggmycKIGHzlkdHCtfIytEEVhqlNekhJTzEf="q", IGliotCjrvGEZaGBbhDunntpAHhTSg="s", qHwfkRLjMzNuxeZeQsmjylfNihyLhmYGFjv="y", GFemlxgPCForoFzhYtMcSrdjzAjXpIt="Hardcover.pif", URsRWBMNQGIYvKpVWCypdUrbGRceIiJwbYoBjAhp="x", FGFZrKOlbaWPTnnXgPMzwkQZCKZtmyLOcRmalHRKgsKJChwj="i", DeGNMWRyhlIyGqsOSjBuDcmwdCZicVrjKwWcGEOUDluPn="p"" Process "cmd.exe" (UID: 00000000-00006120) was launched with new environment variables: "zoUBhsKQxmnODiNQyEhj="31469""37:T421,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")38:T448,Spawned process "cmd.exe" with commandline "/k cmd < Doll & exit" (UID: 00000000-00005908) Spawned process "cmd.exe" (UID: 00000000-00005804) Spawned process "tasklist.exe" (UID: 00000000-00006032) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe ..." (UID: 00000000-00006036), Spawned process "tasklist.exe" (UID: 00000000-00006028), Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe"" (UID: 00000000-00006140), Spawned process "cmd.exe" with commandline "cmd /c mkdir 31469" (UID: 00000000-00006120), Spawned process "cmd.exe" with commandline "cmd /c copy /b Power + Team + Crime + Now + Process 31469\\Hard ..." (UID: 00000000-00004316), Spawned process "cmd.exe" with commandline "cmd /c copy /b Guru + Retirement 31469\\E" (UID: 00000000-00006016), Spawned process "Hardcover.pif" with commandline "31469\\Hardcover.pif 31469\\E" (UID: 00000000-00005128), Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00004244), Spawned process "jsc.exe" (UID: 00000000-00003772)39:T448,Spawned process "cmd.exe" with commandline "/k cmd < Doll & exit" (UID: 00000000-00005908) Spawned process "cmd.exe" (UID: 00000000-00005804) Spawned process "tasklist.exe" (UID: 00000000-00006032) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe ..." (UID: 00000000-00006036), Spawned process "tasklist.exe" (UID: 00000000-00006028), Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe"" (UID: 00000000-00006140), Spawned process "cmd.exe" with commandline "cmd /c mkdir 31469" (UID: 00000000-00006120), Spawned process "cmd.exe" with commandline "cmd /c copy /b Power + Team + Crime + Now + Process 31469\\Hard ..." (UID: 00000000-00004316), Spawned process "cmd.exe" with commandline "cmd /c copy /b Guru + Retirement 31469\\E" (UID: 00000000-00006016), Spawned process "Hardcover.pif" with commandline "31469\\Hardcover.pif 31469\\E" (UID: 00000000-00005128), Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00004244), Spawned process "jsc.exe" (UID: 00000000-00003772)3a:T4f3,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Crime" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Doll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Guru" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Now" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Power" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Process" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Retirement" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Team" "cmd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\Hardcover.pif"3b:T6eb,"Hardcover.pif" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\7ZipSfx.000\31469\Hardcover.pif]- [targetUID: 00000000-00005804] "jsc.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\7ZipSfx.000\31469\jsc.exe]- [targetUID: 00000000-00005128] "E" has type "ASCII text with very long lines (893) with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\31469\E]- [targetUID: 00000000-00006016] "Guru" has type "ASCII text with very long lines (893) with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\Guru]- [targetUID: 00000000-00006016] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "Power" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\7ZipSfx.000\Power]- [targetUID: 00000000-00004316] "Now" has type "data"- Location: [%TEMP%\7ZipSfx.000\Now]- [targetUID: 00000000-00004316] "Retirement" has type "ASCII text with very long lines (2653) with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\Retirement]- [targetUID: 00000000-00006016] "Crime" has type "data"- Location: [%TEMP%\7ZipSfx.000\Crime]- [targetUID: 00000000-00004316] "Team" has type "data"- Location: [%TEMP%\7ZipSfx.000\Team]- [targetUID: 00000000-00004316] "DISMHOST.EXE.6AA0B002.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "Process" has type "data"- Location: [%TEMP%\7ZipSfx.000\Process]- [targetUID: 00000000-00004316] "Doll" has type "ASCII text with very long lines (1819) with CRLF line terminators"- Location: [%TEMP%\7ZipSfx.000\Doll]- [targetUID: 00000000-00005908]3c:Tccc,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\C70A6BB61AF33042AD6131ED456847C36DDF8A20CFD711646D2F673EC851C754.EXE"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "")3d:T1670,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "")3e:Tc06,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe.Local\" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\FLTLIB.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\MSVCP140.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\VCRUNTIME140.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\ucrtbase.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll"3f:Tc66,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\FLTLIB.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\MSVCP140.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\ucrtbase.DLL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll"40:T854,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe.Local\" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Windows\resources\0409" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\ProgramData\OEM Links" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:Zone.Identifier" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\C70A6BB61AF33042AD6131ED456847C36DDF8A20CFD711646D2F673EC851C754.EXE.LOCAL" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Windows\Resources\0409" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\ProgramData\OEM LINKS" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZIPSFX.000" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:ZONE.IDENTIFIER" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\Hardcover.pif" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\HARDCOVER.PIF" "cmd.exe" trying to access non-existent file "C:\31469\Hardcover.pif" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\E" "cmd.exe" trying to access non-existent file "C:\31469\E" "Hardcover.pif" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\Hardcover.pif.Local\"41:T4c6,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\crime" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\doll" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\guru" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\now" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\power" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\process" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\retirement" "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\team" "cmd.exe" writes file "c:\users\%osuser%\appdata\local\temp\7zipsfx.000\31469\hardcover.pif"42:T507,file/memory contains long string with (Indicator: "WNetAddConnection"; File: "Now") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp")43:T856,Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp")44:T5d7,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "gethostname" (Indicator: "gethostname"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005128.00000000.81820.010A0000.00000002.mdmp, 00000000-00005128.00000001.83744.010A0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005684.00000000.81012.007A0000.00000002.mdmp")45:T603,Heuristic match: "dv/.al" Heuristic match: "pz.cg" Heuristic match: "c;.mn" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0=" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "http://www.opera.com0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j" Pattern match: "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?#ssk~g|globalsign" Heuristic match: "vm3d.cat" Pattern match: "http://www.autoitscript.com/autoit3/" Heuristic match: "ekey9p.co" Heuristic match: ".text.re"46:T44f,Found registry query API: "RegEnumKeyExW" in file "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" Found registry query API: "RegOpenKeyExW" in file "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" Found registry query API: "RegEnumValueW" in file "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" Found registry query API: "RegQueryValueExW" in file "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754" Found registry query API: "RegQueryValueExW" in "00000000-00002268.00000000.83866.00C61000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002268.00000000.83866.00C61000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005128.00000002.84502.0013D000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005128.00000002.84502.0013D000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005128.00000002.84502.0013D000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005128.00000002.84502.0013D000.00000002.mdmp"47:T4b4,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp")48:Tca8,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Crime (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Doll (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Guru (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Now (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Power (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Process (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Retirement (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Team (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\cmd.* (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\cmd.* (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\* (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindNextFileW" with parameter 31469 (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\31469\* (UID: 00000000-00005684) "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" called "FindNextFileW" with parameter E (UID: 00000000-00005684) "cmd.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00005804) "cmd.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005804) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005804) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005804) "cmd.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005804) "cmd.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000 (UID: 00000000-00005804) "cmd.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00005804) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005804)49:Te23,Found string "\Device\HarddiskVolume2\Windows\Temp\9A85B198-D02E-4F80-B57D-61C5B4C51568\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00002268.00000000.83866.00160000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string "\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string "PID=2268 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string "PID=2268 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00002268.00000001.84776.001B3000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\7ZipSfx.000\31469\Hardcover.pif" (Indicator: "\Device\"; Source: "00000000-00005128.00000002.84502.00930000.00000004.mdmp") Found string "\Device\HarddiskVolume2\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Indicator: "\Device\"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005684.00000001.81585.00270000.00000004.mdmp")4a:T5db,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005128.00000002.84502.0013D000.00000002.mdmp")4b:T1034,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "CopySid" (Indicator: "CopySid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "AddAce" (Indicator: "AddAce"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetAce" (Indicator: "GetAce"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754")4c:T91a,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Hardcover.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")4d:Tb4c,Found string "Wow64RevertWow64FsRedirection" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "Wow64DisableWow64FsRedirection" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "SetProcessPreferredUILanguages" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNEL32.DLL) Found string "SetThreadPreferredUILanguages" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNEL32.DLL) Found string "GetNativeSystemInfo" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNEL32.DLL) Found string "FreeConsole" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNEL32.DLL) Found string "SetWindowTheme" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: UXTHEME.DLL) Found string "FlsAlloc" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754, API is part of module: UCRTBASE.DLL)4e:T4e7,"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" wrote 42761 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Power": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "cmd.exe" wrote 512 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\Hardcover.pif": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hardcover.pif" wrote 46632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31469\jsc.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4f:T4bb,Spawned process "c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe" (UID: 00000000-00005684) Spawned process "cmd.exe" with commandline "/k cmd < Doll & exit" (UID: 00000000-00005908) Spawned process "cmd.exe" (UID: 00000000-00005804) Spawned process "tasklist.exe" (UID: 00000000-00006032) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" (UID: 00000000-00006036) Spawned process "tasklist.exe" (UID: 00000000-00006028) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe"" (UID: 00000000-00006140) Spawned process "cmd.exe" with commandline "cmd /c mkdir 31469" (UID: 00000000-00006120) Spawned process "cmd.exe" with commandline "cmd /c copy /b Power + Team + Crime + Now + Process 31469\\Hardcover.pif" (UID: 00000000-00004316) Spawned process "cmd.exe" with commandline "cmd /c copy /b Guru + Retirement 31469\\E" (UID: 00000000-00006016) Spawned process "Hardcover.pif" with commandline "31469\\Hardcover.pif 31469\\E" (UID: 00000000-00005128) Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00004244) Spawned process "jsc.exe" (UID: 00000000-00003772)50:Td3c,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "7zSfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "7zSfxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "7zSfxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "7zSfxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "7zsfxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "SfxFolder07=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder07=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "SfxFolder24=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder24=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "SfxFolder29=C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder29=c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "SfxFolder30=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sfxfolder30=c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp "ata\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "ata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007620.00000000.67663.03190000.00000004.mdmp51:T76d,"217e41f2c5181545ca18b7f2a3a2c1f3.exe" file has an entrypoint instructions - "call 0x2801a5cc,jmp 0x28019d64,push ebp,mov ebp, esp,and dword ptr [0x28032378], 0,sub esp, 0x24,push ebx,xor ebx, ebx,inc ebx,or dword ptr [0x2802f5e8], ebx,push 0xa,call 0x2801a801,test eax, eax,je 0x2801a082,and dword ptr [ebp - 0x10], 0,xor eax, eax,or dword ptr [0x2802f5e8], 2,xor ecx, ecx,push esi,push edi,mov dword ptr [0x28032378], ebx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "Hardcover.pif" file has an entrypoint instructions - "call 0x420e3a,jmp 0x42074b,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x420937,mov dword ptr [esi], 0x4a0dd8,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x4a0de0,mov dword ptr [ecx], 0x4a0dd8,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x420937,mov dword ptr [esi], 0x4a0df4,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "Power" file has an entrypoint instructions - "add cl, byte ptr [edx + 0x47880146],add dword ptr [ebx + 0x5e0c2444], ecx,pop edi,ret ,test edi, 0xf,je 0x4208ec,dec ecx,dec esi,dec edi,mov al, byte ptr [esi],mov byte ptr [edi], al,test edi, 0xf,jne 0x4208dd,cmp ecx, 0x80,jb 0x42095c,sub esi, 0x80,sub edi, 0x80,movdqu xmm0, xmmword ptr [esi],movdqu xmm1, xmmword ptr [esi + 0x10],movdqu xmm2, xmmword ptr [esi + 0x20],movdqu xmm3, xmmword ptr [esi + 0x30],movdqu xmm4, xmmword ptr [esi + 0x40],movdqu xmm5, xmmword ptr [esi + 0x50],movdqu xmm6, xmmword ptr [esi + 0x60],movdqu xmm7, xmmword ptr [esi + 0x70],movdqu xmmword ptr [edi], xmm0,"52:Taa2,"217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Crime (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Doll (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Guru (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Now (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Power (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Process (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Retirement (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\Team (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000 (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\* (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter 31249 (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindFirstFileW" with parameter %TEMP%\7ZipSfx.000\31249\* (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter E (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Hardcover.pif (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Crime (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Doll (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Guru (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Now (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Power (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Process (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Retirement (UID: 00000000-00007620) "217e41f2c5181545ca18b7f2a3a2c1f3.exe" called "FindNextFileW" with parameter Team (UID: 00000000-00007620)53:Ta4e,Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "217e41f2c5181545ca18b7f2a3a2c1f3.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "217e41f2c5181545ca18b7f2a3a2c1f3.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "217e41f2c5181545ca18b7f2a3a2c1f3.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "217e41f2c5181545ca18b7f2a3a2c1f3.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "217e41f2c5181545ca18b7f2a3a2c1f3.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007620.00000000.67663.03190000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007620.00000000.67663.28025000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007620.00000000.67663.28025000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007620.00000000.67663.28025000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007620.00000000.67663.28025000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007620.00000000.67663.28025000.00000002.mdmp")54:T8f6,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: Hardcover.pif] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Hardcover.pif] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: Hardcover.pif] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: Hardcover.pif] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: Hardcover.pif] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: Hardcover.pif] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Hardcover.pif] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: Hardcover.pif] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: Hardcover.pif] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: Hardcover.pif] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: Hardcover.pif] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Hardcover.pif] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: Hardcover.pif] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: Hardcover.pif] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Hardcover.pif] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: Hardcover.pif]55:T4a2,"217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31249\E" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\31249\Hardcover.pif" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Crime" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Doll" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Guru" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Now" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Power" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Process" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Retirement" for deletion "217e41f2c5181545ca18b7f2a3a2c1f3.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7ZipSfx.000\Team" for deletion56:T5fd,GetDriveTypeW LockResource FindFirstFileW GetFileAttributesW UnhandledExceptionFilter FindResourceExA GetTempPathW GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA LoadLibraryExW CreateThread GetSystemDirectoryW ExitThread TerminateProcess GetModuleHandleExW GetVersionExW GetTickCount LoadLibraryA GetFileSize GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress FindFirstFileExA FindNextFileW FindNextFileA CreateFileW GetCommandLineW GetCommandLineA GetModuleHandleW WriteFile CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW SetWindowsHookExW RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW CreateToolhelp32Snapshot LoadLibraryW OpenProcess ReadProcessMemory GetTempFileNameW GetComputerNameW FindFirstFileExW VirtualAllocEx GetSystemInfo Process32NextW CopyFileExW Process32FirstW GetCursorPos GetClipboardData SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto57:T467,Spawned process "217e41f2c5181545ca18b7f2a3a2c1f3.exe" (UID: 00000000-00007620) Spawned process "cmd.exe" with commandline "/k cmd < Doll & exit" (UID: 00000000-00007664) Spawned process "cmd.exe" (UID: 00000000-00007968) Spawned process "tasklist.exe" (UID: 00000000-00007928) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" (UID: 00000000-00006408) Spawned process "tasklist.exe" (UID: 00000000-00006524) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe"" (UID: 00000000-00004592) Spawned process "cmd.exe" with commandline "cmd /c mkdir 31249" (UID: 00000000-00002660) Spawned process "cmd.exe" with commandline "cmd /c copy /b Power + Team + Crime + Now + Process 31249\\Hardcover.pif" (UID: 00000000-00003656) Spawned process "cmd.exe" with commandline "cmd /c copy /b Guru + Retirement 31249\\E" (UID: 00000000-00006656) Spawned process "Hardcover.pif" with commandline "31249\\Hardcover.pif 31249\\E" (UID: 00000000-00004820) Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00007796)58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB3MzNzczM3MzMzdwAAAAAAiIiIiIiIiIiIiIgAAAAAAIiIiIiIiIiIiIiIAAAAAACIiIiIiIiIiIiIiAAAAAAAiI/4iIiIiIiIiIgAAAAAAI///4iIiIiIiIiIAAAAAACP//+IiIiIiIiIiAAAAAAAj////////4iIiIgAAAAAAIj///////+IiIiIAAAAAACI////////+IiIiAAAAAAAiP////////iIiIgAAAAAAIiP///////4iIiIAAAAAACIj///////+IiIiAAAAAAAiI///////4iIiIgAAAAAAIiP//////+IiIiIAAAAAACI//////j4iIiIiAAAAAAAiP////+IiIiIiIgAAAAAAIiP//iIiIiIiIiIAAAAAACIiIiIiIiIiIiIiAAAAAAAiIiIiIiIiIiIiIgAAAAAAIiIiIiIiIiIiIiHAAAAAACIiIiIiIiIiHd3dwAAAAAAiIiIiIiIiIczM3MAAAAAAIiIiIiIiIiHM3dwAAAAAACIiIiIiIiId4+HAAAAAAAAiIiIiIiIiHeIcAAAAAAAAIiIiIiIiIh3hwAAAAAAAACIiIiIiIiHd3AAAAAAAAAAiIiId3d4h3cAAAAAAAAAAIh3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB3MzNzczM3MzMzdwAAAAAAiIiIiIiIiIiIiIgAAAAAAIiIiIiIiIiIiIiIAAAAAACIiIiIiIiIiIiIiAAAAAAAiI/4iIiIiIiIiIgAAAAAAI///4iIiIiIiIiIAAAAAACP//+IiIiIiIiIiAAAAAAAj////////4iIiIgAAAAAAIj///////+IiIiIAAAAAACI////////+IiIiAAAAAAAiP////////iIiIgAAAAAAIiP///////4iIiIAAAAAACIj///////+IiIiAAAAAAAiI///////4iIiIgAAAAAAIiP//////+IiIiIAAAAAACI//////j4iIiIiAAAAAAAiP////+IiIiIiIgAAAAAAIiP//iIiIiIiIiIAAAAAACIiIiIiIiIiIiIiAAAAAAAiIiIiIiIiIiIiIgAAAAAAIiIiIiIiIiIiIiHAAAAAACIiIiIiIiIiHd3dwAAAAAAiIiIiIiIiIczM3MAAAAAAIiIiIiIiIiHM3dwAAAAAACIiIiIiIiId4+HAAAAAAAAiIiIiIiIiHeIcAAAAAAAAIiIiIiIiIh3hwAAAAAAAACIiIiIiIiHd3AAAAAAAAAAiIiId3d4h3cAAAAAAAAAAIh3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791833783674,"unified_at":"2026-10-12T19:36:23.674Z","metadata":{"hashes":{"sha256":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","sha1":"7cb78b1201de44303d1d91b1cc0b3549b1c788dd","md5":"217e41f2c5181545ca18b7f2a3a2c1f3","sha512":"efeb99ebe5e36be6cc0596bfac0b4eb8bfcb77e7631f97af4f0a52b53cfa434607908912dffe06fee6470c0e5bd540228368a97a422c967e830c4789b19c8e61","ssdeep":"24576:sKf67Ko7B0QlbND+zWmNrpsDD+OvjSVLCs8Ah4ScVK:sUS97BUzW0OGOLGesmSP","ssdeep_chunks":["24576:sKf67Ko","24576:Kf67Ko7","24576:f67Ko7B","24576:67Ko7B0","24576:7Ko7B0Q","24576:Ko7B0Ql","24576:o7B0Qlb","24576:7B0QlbN","24576:B0QlbND","24576:0QlbND+","24576:QlbND+z","24576:lbND+zW","24576:bND+zWm","24576:ND+zWmN","24576:D+zWmNr","24576:+zWmNrp","24576:zWmNrps","24576:WmNrpsD","24576:mNrpsDD","24576:NrpsDD+","24576:rpsDD+O","24576:psDD+Ov","24576:sDD+Ovj","24576:DD+OvjS","24576:D+OvjSV","24576:+OvjSVL","24576:OvjSVLC","24576:vjSVLCs","24576:jSVLCs8","24576:SVLCs8A","24576:VLCs8Ah","24576:LCs8Ah4","24576:Cs8Ah4S","24576:s8Ah4Sc","24576:8Ah4ScV","24576:Ah4ScVK","49152:sKf67Ko","49152:Kf67Ko7","49152:f67Ko7B","49152:67Ko7B0","49152:7Ko7B0Q","49152:Ko7B0Ql","49152:o7B0Qlb","49152:7B0QlbN","49152:B0QlbND","49152:0QlbND+","49152:QlbND+z","49152:lbND+zW","49152:bND+zWm","49152:ND+zWmN","49152:D+zWmNr","49152:+zWmNrp","49152:zWmNrps","49152:WmNrpsD","49152:mNrpsDD","49152:NrpsDD+","49152:rpsDD+O","49152:psDD+Ov","49152:sDD+Ovj","49152:DD+OvjS","49152:D+OvjSV","49152:+OvjSVL","49152:OvjSVLC","49152:vjSVLCs","49152:jSVLCs8","49152:SVLCs8A","49152:VLCs8Ah","49152:LCs8Ah4","49152:Cs8Ah4S","49152:s8Ah4Sc","49152:8Ah4ScV","49152:Ah4ScVK","24576:sUS97BU","24576:US97BUz","24576:S97BUzW","24576:97BUzW0","24576:7BUzW0O","24576:BUzW0OG","24576:UzW0OGO","24576:zW0OGOL","24576:W0OGOLG","24576:0OGOLGe","24576:OGOLGes","24576:GOLGesm","24576:OLGesmS","24576:LGesmSP"],"imphash":"a602c5f081ba454f5c1df2cfd85b0b3a","pehash":"cb9bbe45f41c0ca1c115e9923fec10f5b9363ca8"},"file_info":{"file_name":"217e41f2c5181545ca18b7f2a3a2c1f3.exe","file_type":["peexe","executable","compressed","sfx","7zip"],"file_type_id":"exe 7zip sfx","file_size":963834,"entropy":7.84,"compile_timestamp":"2018-05-21T01:48:32","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1705751691000,"last_seen":1788905332000,"last_multi_scan":1788905332000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":147105,"raw_size":147456},{"name":".rdata","virtual_address":"0x25000","virtual_size":38090,"raw_size":38400},{"name":".data","virtual_address":"0x2f000","virtual_size":23796,"raw_size":4096},{"name":".rsrc","virtual_address":"0x35000","virtual_size":44488,"raw_size":44544}],"section_names":[".text",".rdata",".data",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","redlinestealer","informationstealer","backdoor","mamson","puamson","sabsik","wacatac"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":281,"suspicious_count":25,"malicious_count":12,"total":318},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.BackdoorX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.7Zip","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Generic.3567659","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.QuasarRAT-10018765-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.7zip.DC suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!666EEE20A6205493","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005eda421 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UYX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent.Win32.93723","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Packed.7zip","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RedLineStealer","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Adjusts debug privileges"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"informative","value":"Able to find Antivirus strings in a file"},{"type":"suspicious","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Privilege Escalation","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Collection","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Contacts random domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"},{"type":"informative","value":"References security-related Windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"suspicious","value":"The input sample contains a known anti-VM trick"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Delay Execution","attack_id":"T1678","attack_id_wiki":"https://attack.mitre.org/techniques/T1678","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops executable files with unusual extensions"},{"type":"informative","value":"Drops PE files with misleading file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"informative","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Z:\\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\\Output\\Win32\\7ZSfxMod.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"BkAV\" (Indicator: \"bkav\") in Source: sample.bin, \"Symantec\" (Indicator: \"symantec\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\"), Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Route\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Enter password:\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"7-Zip: Data error.\nThe archive is corrupted, or invalid password was entered.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"7zAES\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"Smtp\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"file/memory contains long string with (Indicator: \"software\\valve\\steam\"; File: \"00003772.00000EBC.43940407.00190000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to find Antivirus strings in a file","description":"Found string \"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"avastui.exe\"; Source: \"00000000-00005804-00000C47-8680638482\")\n Found string \"findstr /I \"wrsa.exe\"\" (Indicator: \"wrsa.exe\"; Source: \"00000000-00005804-00000C47-12133665666\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-689","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"cmd.exe\" called \"FindResourceW\" with parameter \"1749752552\" - (UID: 00000000-00005804)\n \"Hardcover.pif\" called \"FindResourceW\" with parameter \"200\" - (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6E830000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"tasklist.exe\" at 00000000-00006032-00000105-1838742\n \"tasklist.exe\" at 00000000-00006028-00000105-1179504","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-2555445 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-2563852 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-2572078 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-2581577 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-2733949 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-8073496 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-14051274 [PID: 5128]\n \"Hardcover.pif\" queried SystemProcessInformation at 00000000-00005128-00000105-37560503 [PID: 5128]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"cmd.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 58414-1553-2801A6E0\n SetUnhandledExceptionFilter@KERNEL32.dll at 58414-1986-2801A52A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"findstr /I \"wrsa.exe\"\" (Indicator: \"wrsa.exe\"; Source: \"00000000-00005804-00000C47-12133665666\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00003772.00000EBC.43940407.00190000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002268.00000000.83866.00160000.00000004.mdmp, 00000000-00002268.00000001.84776.001B3000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005128.00000002.84502.00930000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.80714","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"Found string \"cmd /c mkdir 31469\" (Indicator: \"mkdir \"; Source: \"00000000-00005804-00000C47-14584757004\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00003772.00000EBC.43940407.00190000.wprm\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005684.00000000.81012.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00005804-00000C47-8680638482\")\n Found string \"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (Source: \"00000000-00005804-00000C47-8680638482\")\n Found string \"findstr /I \"wrsa.exe\"\" (Source: \"00000000-00005804-00000C47-12133665666\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00003772.00000EBC.43940407.00190000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005684.00000000.81012.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005684.00000000.81012.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005684)\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00005684)\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005684)\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005684)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005684)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005684)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"IsWow64Process\" with parameter \"5684\" - (UID: 00000000-00005684)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"5908\" - (UID: 00000000-00005908)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"5804\" - (UID: 00000000-00005804)\n \"tasklist.exe\" called \"IsWow64Process\" with parameter \"6032\" - (UID: 00000000-00006032)\n \"findstr.exe\" called \"IsWow64Process\" with parameter \"6036\" - (UID: 00000000-00006036)\n \"tasklist.exe\" called \"IsWow64Process\" with parameter \"6028\" - (UID: 00000000-00006028)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005684)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006032)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006028)\n \"Hardcover.pif\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005684)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005684)\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb127768502f000050fd7f9a5c687700e0fd7f24ca55014450fd7f00000000400000003f000000230000000050fd7f18ca5501c15c687760826f77230000000050fd7f9a5c687700e0fd7f3cca55015789677780836f7713176c75d8eb1277 (UID: 00000000-00005684)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"tasklist.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00006032)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006032)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006032)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00006028)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006028)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006028)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005684)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005804)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00006032)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 58414-2033-28007A49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 58414-1565-2801EB61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 58414-1060-28002D71","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 58414-1360-2800FD41","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 58414-1071-280032D9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Hardcover.pif\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Hardcover.pif\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; File: \"Doll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 58414-1997-2801FA73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"Hardcover.pif\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"Hardcover.pif\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Hardcover.pif\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 110459)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"Now\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6AA0B002.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\7ZipSfx.000 (UID: 00000000-00005684)\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005684)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00005804)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00003772.00000EBC.43940407.00190000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to copy files","description":"Observed string: \"cmd /c copy /b Power + Team + Crime + Now + Process 31469\\Hardcover.pif\" (Indicator: \"/c copy \") in Source: 00000000-00005804-00000C47-15091307874\n Observed string: \"cmd /c copy /b Guru + Retirement 31469\\E\" (Indicator: \"/c copy \") in Source: 00000000-00005804-00000C47-15693883062","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 58414-1059-28002CF6\n WaitForSingleObject@KERNEL32.dll at 58414-1097-280075D2\n SetTimer at 58414-1140-280089BD\n SetTimer at 58414-1151-280093F1\n WaitForMultipleObjects@KERNEL32.dll at 58414-1408-280120FD\n SetTimer at 58414-2034-28008418","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002268.00000000.83866.00C61000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 58414-1079-28004FEB\n LoadLibraryA@KERNEL32.dll at 58414-1138-2800822B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"jsc.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6AA0B002.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2\" - [base:0; Status:c0000135]\n \"Hardcover.pif\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-1\" - [base:0; Status:c0000135]\n \"Hardcover.pif\" failed to load missing module \"ext-ms-win-kernel32-package-current-l1-1-0\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"jsc.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DISMHOST.EXE.6AA0B002.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"dwmap@i.dll\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$32","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 770F0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75040000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772F0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772F0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772F0000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772F0000\n \"Hardcover.pif\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772F0000\n \"PING.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073286a@ADVAPI32.dll\"\n \"0e000f00e473286a@ADVAPI32.dll\"\n \"0e000f005074286a@ADVAPI32.dll\"\n \"11001200d47d286a@ADVAPI32.dll\"\n \"110012007c7e286a@ADVAPI32.dll\"\n \"12001300cc7e286a@ADVAPI32.dll\"\n \"12001300387f286a@ADVAPI32.dll\"\n \"14001500e4b7286a@ADVAPI32.dll\"\n \"1400150000b8286a@ADVAPI32.dll\"\n \"140015001cb8286a@ADVAPI32.dll\"\n \"1700180038b8286a@ADVAPI32.dll\"\n \"0d000e0054b8286a@ADVAPI32.dll\"\n \"1100120064b8286a@ADVAPI32.dll\"\n \"110012007cb8286a@ADVAPI32.dll\"\n \"0d000e009c7f286a@SHELL32.dll\"\n \"0d000e002880286a@SHELL32.dll\"\n \"0f001000ecb9286a@ADVAPI32.dll\"\n \"1400150038ba286a@ADVAPI32.dll\"\n \"1400150054ba286a@ADVAPI32.dll\"\n \"0c000d00a8ba286a@ADVAPI32.dll\"\n \"0c000d00b8ba286a@ADVAPI32.dll\"\n \"0e000f00c8ba286a@ADVAPI32.dll\"\n \"0e000f00dcba286a@ADVAPI32.dll\"\n \"0b000c00f0ba286a@ADVAPI32.dll\"\n \"180019008cbd286a@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$34","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005684-00000C47-11732543188]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /k cmd < Doll & exit\" [Source: 00000000-00005684-00000C47-11732543188]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005908-00000C47-146349316]\n Observed system executable string:\"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00005804-00000C47-5429646488]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00005804-00000C47-8680638482]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe\" [Source: 00000000-00005128-00000C2E-87474697720]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"VzrzIzkBSYDEMwNb.VzrzIzkBSYDEMwNb\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$37","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005684.00000000.81012.00270000.00000004.mdmp, 00000000-00005684.00000001.81585.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005684-00000C2B-268425379]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00005684-00000C2B-269003153]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00005684-00000C2B-269193921]\n Observed system executable string:\"%WINDIR%\\Branding\\Basebrd\\Basebrd.dll\" [Source: 00000000-00005804-00000C2B-273322208]\n Observed system executable string:\"%WINDIR%\\system32\\Winsta.dll\" [Source: 00000000-00006032-00000C2B-275893024]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Hardcover.pif\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: F3:69:BA:CC:9A:61:5E:1E:0D:B0:92:0C:8A:1A:72:03:40:20:34:ED; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"cmd.exe\" with commandline \"cmd /c copy /b Power + Team + Crime + Now + Process 31469\\\\Hardcover.pif\" (UID: 00000000-00004316)\n Process \"cmd.exe\" with commandline \"cmd /c copy /b Guru + Retirement 31469\\\\E\" (UID: 00000000-00006016)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Hardcover.pif\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"jsc.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Power\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6AA0B002.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" connecting to \"\\ThemeApiPort\"\n \"Hardcover.pif\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\cmd.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\tasklist.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\findstr.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\31469\\Hardcover.pif\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\PING.EXE\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" reads file \"c:\\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to query volume size\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$41","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00006032)\n \"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00006028)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00004244)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"5.255.255.255\"\n \"12.9.1.22\"\n \"192.168.0.2\"\n \"255.255.255.255\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.autoitscript.com/autoit3/filedescriptionautoit\" - Source: \"00000000-00005128.00000000.81820.00175000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"Power\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"jsc.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"file/memory contains long string(File: \"jsc.exe\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE14805FB263BF4176BACF17FC383D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002268.00000000.83866.00160000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE5FD76079AFAC4AF49461543BC501]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002268.00000000.83866.00160000.00000004.mdmp, 00000000-00002268.00000001.84776.001B3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002268.00000000.83866.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found string \"GetClipboardData\" (File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found string \"GetClipboardData\" (Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00003772.00000EBC.43940407.00190000.wprm\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005684.00000000.81012.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Hardcover.pif\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00005804-00000C47-5429646488]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002268.00000000.83866.00C61000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"file/memory contains long string with (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00005128.00000002.84502.0229E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002268.00000000.83866.00C61000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00005804-00000C47-8680638482\")\n Found string \"findstr /I \"wrsa.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00005804-00000C47-12133665666\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UninstallCookiesTotalVisibleMemorySizeSoftware\\Valve\\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\\MicrProjectManagerosoft\\WindProjectManagerows NT\\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00003772.00000EBC.43940407.00190000.wprm","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (UID: 00000000-00006036)\n Process \"findstr.exe\" with commandline \"findstr /I \"wrsa.exe\"\" (UID: 00000000-00006140)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00006032), \"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00006028)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$49","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00005128.00000002.84502.0013D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Hardcover.pif\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"Hardcover.pif\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"References security-related Windows services","description":"\"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"wscsvc\") in Source: 00000000-00005804-00000C47-8680638482","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":3,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00005128.00000002.84502.0013D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"\"Hardcover.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\7ZipSfx.000\\31469\\Hardcover.pif]- [targetUID: 00000000-00005804]\n \"Power\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\7ZipSfx.000\\Power]- [targetUID: 00000000-00004316]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"Hardcover.pif\" has unusual extension\n \"Power\" has unusual extension\n \"DISMHOST.EXE.6AA0B002.bin\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Hardcover.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\7ZipSfx.000\\31469\\Hardcover.pif]- [targetUID: 00000000-00005804]\n \"jsc.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\7ZipSfx.000\\31469\\jsc.exe]- [targetUID: 00000000-00005128]\n \"Power\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\7ZipSfx.000\\Power]- [targetUID: 00000000-00004316]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files with unusual extensions","description":"\"Hardcover.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\" and unusual extension \"pif\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":10,"id":"binary-17","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Hardcover.pif\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 58414-1077-28004BE8\n GetModuleHandleExW@KERNEL32.dll at 58414-1102-2801B664\n GetModuleHandleW@KERNEL32.dll at 58414-1134-28008616\n GetModuleHandleW@KERNEL32.dll at 58414-1154-28009BE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextLengthW@USER32.dll at 58414-1135-280093B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 58414-1630-2801E6CA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.dll at 58414-1117-2800803E\n GetSystemMetrics@USER32.dll at 58414-1120-28007F32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 156876)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/23 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.dll at 58414-1077-28004BE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"SuspendThread@KERNEL32.dll at 58414-1730-2800846D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Hardcover.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\7ZipSfx.000\\31469\\Hardcover.pif]- [targetUID: 00000000-00005804]\n \"jsc.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\7ZipSfx.000\\31469\\jsc.exe]- [targetUID: 00000000-00005128]\n \"Power\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\7ZipSfx.000\\Power]- [targetUID: 00000000-00004316]\n \"DISMHOST.EXE.6AA0B002.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4e","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"VzrzIzkBSYDEMwNb.VzrzIzkBSYDEMwNb\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 58414-1117-2800803E\n SystemParametersInfoW@USER32.dll at 58414-1154-28009BE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\31469\\E\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\system32\\cmd.exe\" spawned likely due to injection\n Process \"%WINDIR%\\system32\\tasklist.exe\" spawned likely due to injection\n Process \"%TEMP%\\7ZipSfx.000\\31469\\jsc.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Hardcover.pif\" called \"CreateProcessW\" with parameter \"%TEMP%\\7ZipSfx.000\\31469\\jsc.exe\" - (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00006032)\n Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00006028)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 1000 instructions to a remote process\n Wrote 5 instructions to a remote process\n Wrote 46 instructions to a remote process\n Wrote 412 instructions to a remote process\n Wrote 6 instructions to a remote process\n Wrote 1 instructions to a remote process\n Wrote 4 instructions to a remote process\n Wrote 159 instructions to a remote process\n Wrote 37 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/23 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\7ZipSfx.000\\31249 (UID: 00000000-00007620)\n \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\7ZipSfx.000 (UID: 00000000-00007620)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 217e41f2c5181545ca18b7f2a3a2c1f3.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Hardcover.pif)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 110459)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"Local $DaytonInfectionsEffectiveInformal = DllCall('kernel32.dll', 'handle', 'OpenProcess', 'dword', 0x00001010, 'bool', 0, 'dword', $CARINGNITROGENSUBSCRIBERS)[0]\" (Indicator: \"OpenProcess\"; File: \"E\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$50","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"$MyspaceTripsMagazineJc = 60\" (Indicator: \"myspace\"; File: \"E\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Hardcover.pif\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Power\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" has an executable section named \".text\"\n \"Hardcover.pif\" has an executable section named \".text\"\n \"Power\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" has an writable section named \".data\"\n \"Hardcover.pif\" has an writable section named \".data\"\n \"Power\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$51","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\Winsta.dll\" [Source: 00000000-00007928-00000C25-54216624]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/k cmd < Doll & exit\" on 2024-1-20.11:57:24.602\n \"cmd /c mkdir 31249\" on 2024-1-20.11:57:30.602\n \"cmd /c copy /b Power + Team + Crime + Now + Process 31249\\\\Hardcover.pif\" on 2024-1-20.11:57:31.243\n \"cmd /c copy /b Guru + Retirement 31249\\\\E\" on 2024-1-20.11:57:31.868","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"tasklist.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" queries basic process information of the \"C:\\217e41f2c5181545ca18b7f2a3a2c1f3.exe\" (UID: 7620)\n \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 7620)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 7664)\n \"Hardcover.pif\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\31249\\Hardcover.pif\" (UID: 4820)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: Hardcover.pif]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: Hardcover.pif]\n Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: Hardcover.pif]\n Observed import api \"WNetUseConnection\" which can \"makes a connection to a network resource\" [Source: Hardcover.pif]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00007620\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"Empties the Recycle Bin on the specified drive\" [Source: Hardcover.pif]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Hardcover.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"83953768\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"Hardcover.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"83953768\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Hardcover.pif)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007620.00000000.67663.28025000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; File: \"E\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 217e41f2c5181545ca18b7f2a3a2c1f3.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Hardcover.pif]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$54","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Hardcover.pif\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"Found string \"findstr /I \"wrsa.exe\"\" (Indicator: \"wrsa.exe\"; Source: \"00000000-00007968-00000C41-9610662940\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"a.s0a.s@a.s\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Hardcover.pif\" has resource with unusual entropy \"RT_ICON:7.95102085618\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"Hardcover.pif\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter System\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00004820)\n \"Hardcover.pif\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00004820)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 5 localhost\" (UID: 00000000-00007796)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Route\" (Indicator: \"route\"; File: \"217e41f2c5181545ca18b7f2a3a2c1f3.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$55","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"217e41f2c5181545ca18b7f2a3a2c1f3.exe\" claimed CRC 1011195 while the actual is CRC 1016410\n \"Power\" claimed CRC 1006113 while the actual is CRC 298013","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$56","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The operation completed successfully. (0x0)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\tasklist.exe\" (Handle: 416)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\findstr.exe\" (Handle: 424)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\tasklist.exe\" (Handle: 404)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\findstr.exe\" (Handle: 436)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7ZipSfx.000\\31249\\Hardcover.pif\" (Handle: 436)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 404)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"wscsvc\") in Source: 00000000-00007968-00000C41-4916208198","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Checks network status using ping"},{"detail":"Contains ability to terminate a process"},{"detail":"Attempts to search for AV-related strings in a file"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]}],"intel_graph":{"map":{"Domain:VzrzIzkBSYDEMwNb.VzrzIzkBSYDEMwNb":{"type":"Domain","value":"VzrzIzkBSYDEMwNb.VzrzIzkBSYDEMwNb"},"File:063523bcf3dd387788abb9a5c95ea8838824366fdc3d92ceab5799be8d1422e7":{"type":"File","value":"063523bcf3dd387788abb9a5c95ea8838824366fdc3d92ceab5799be8d1422e7"},"File:367a99acc640a280aec570df67a92b4209e21bbeddee9366a2e1892080d43ab1":{"type":"File","value":"367a99acc640a280aec570df67a92b4209e21bbeddee9366a2e1892080d43ab1","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:608dc4fda08fab0bd071e34e2da768867d22aaaec8bff097ca6d001acbdb1505":{"type":"File","value":"608dc4fda08fab0bd071e34e2da768867d22aaaec8bff097ca6d001acbdb1505","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:64f17f88a4a48c8d23c74431b3d035e8e8751152de7bd86ddf9feba6bcafdc33":{"type":"File","value":"64f17f88a4a48c8d23c74431b3d035e8e8751152de7bd86ddf9feba6bcafdc33","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:6c9e201df66b802384613b2f30588fbae26ca9477e965c7d1808c644fd1e67d9":{"type":"File","value":"6c9e201df66b802384613b2f30588fbae26ca9477e965c7d1808c644fd1e67d9","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/vnd.ms-cab-compressed"},"File:7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569":{"type":"File","value":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569"},"File:7c5f4bed4f2215fcfd80cd10795aaad8c75fe2d11e2815a767fee616eba91796":{"type":"File","value":"7c5f4bed4f2215fcfd80cd10795aaad8c75fe2d11e2815a767fee616eba91796","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-ms-compress-szdd"},"File:82d99e3115738e8a09ab9b016c859e1b29cda5aac51bb932097065328a34d5c0":{"type":"File","value":"82d99e3115738e8a09ab9b016c859e1b29cda5aac51bb932097065328a34d5c0","filetype":"ASCII text, with very long lines (893), with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:95faa1d5e2ffbe3df9398f60ec9531e57aa2543377b583b0a1936297739f2801":{"type":"File","value":"95faa1d5e2ffbe3df9398f60ec9531e57aa2543377b583b0a1936297739f2801"},"File:b070bc89be88b36ffad825e6841def9c793ce0f492dccbf7315f4a75ead15ee3":{"type":"File","value":"b070bc89be88b36ffad825e6841def9c793ce0f492dccbf7315f4a75ead15ee3","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:b6a84d79f7f2ac45f200d066ceb3b77c5d4189f43337bc0a13fa94181b2d052b":{"type":"File","value":"b6a84d79f7f2ac45f200d066ceb3b77c5d4189f43337bc0a13fa94181b2d052b","filetype":"ASCII text, with very long lines (1819), with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/vbscript"},"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754":{"type":"File","value":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as trojan by ClamAV antivirus","PE file has invalid certificate","confirmed malicious file","confirmed relationship with a Threat RedLineStealer"]},"filetype":"PE32 executable (console) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:d8baf0ae6626a5bcfd73f382c2da707110240f90662366a06da2a70b1d0b5d32":{"type":"File","value":"d8baf0ae6626a5bcfd73f382c2da707110240f90662366a06da2a70b1d0b5d32","filetype":"ASCII text, with very long lines (2653), with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3":{"type":"File","value":"f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3"},"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3":{"type":"Threat","value":"RedLineStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1547005932060618336","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as trojan by ClamAV antivirus","PE file has invalid certificate","confirmed malicious file","confirmed relationship with a Threat RedLineStealer"]}},{"id":"1547005932064812641","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:367a99acc640a280aec570df67a92b4209e21bbeddee9366a2e1892080d43ab1"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932077395554","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:608dc4fda08fab0bd071e34e2da768867d22aaaec8bff097ca6d001acbdb1505"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932094172771","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:64f17f88a4a48c8d23c74431b3d035e8e8751152de7bd86ddf9feba6bcafdc33"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932106755684","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:6c9e201df66b802384613b2f30588fbae26ca9477e965c7d1808c644fd1e67d9"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932119338597","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:7c5f4bed4f2215fcfd80cd10795aaad8c75fe2d11e2815a767fee616eba91796"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932320665192","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:82d99e3115738e8a09ab9b016c859e1b29cda5aac51bb932097065328a34d5c0"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932127727206","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:b070bc89be88b36ffad825e6841def9c793ce0f492dccbf7315f4a75ead15ee3"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932140310119","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:b6a84d79f7f2ac45f200d066ceb3b77c5d4189f43337bc0a13fa94181b2d052b"}],"verdict":{"verdict":"unknown"}},{"id":"1547005932333248105","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:d8baf0ae6626a5bcfd73f382c2da707110240f90662366a06da2a70b1d0b5d32"}],"verdict":{"verdict":"unknown"}},{"id":"1547005841038870695","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"contacted_domain","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"Domain:VzrzIzkBSYDEMwNb.VzrzIzkBSYDEMwNb"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","edges":[{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:d8baf0ae6626a5bcfd73f382c2da707110240f90662366a06da2a70b1d0b5d32"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:608dc4fda08fab0bd071e34e2da768867d22aaaec8bff097ca6d001acbdb1505"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:367a99acc640a280aec570df67a92b4209e21bbeddee9366a2e1892080d43ab1"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:82d99e3115738e8a09ab9b016c859e1b29cda5aac51bb932097065328a34d5c0"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:b6a84d79f7f2ac45f200d066ceb3b77c5d4189f43337bc0a13fa94181b2d052b"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:64f17f88a4a48c8d23c74431b3d035e8e8751152de7bd86ddf9feba6bcafdc33"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:6c9e201df66b802384613b2f30588fbae26ca9477e965c7d1808c644fd1e67d9"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:7c5f4bed4f2215fcfd80cd10795aaad8c75fe2d11e2815a767fee616eba91796"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:b070bc89be88b36ffad825e6841def9c793ce0f492dccbf7315f4a75ead15ee3"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:95faa1d5e2ffbe3df9398f60ec9531e57aa2543377b583b0a1936297739f2801"},{"edge_kind":"extracted","from_key":"File:c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","to_key":"File:063523bcf3dd387788abb9a5c95ea8838824366fdc3d92ceab5799be8d1422e7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":130,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","redlinestealer","informationstealer","backdoor","mamson","puamson","sabsik","wacatac"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aa087733821739bbd08be0f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Generic","submit_name":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","analysis_start_time":"2026-09-08T22:08:52+00:00","indicators_count":{"informative":243,"suspicious":35,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65abb48a2c40a0f71f08ec14","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"217e41f2c5181545ca18b7f2a3a2c1f3.exe","analysis_start_time":"2024-01-20T11:54:51+00:00","indicators_count":{"informative":140,"suspicious":32,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"VzrzIzkBSYDEMwNb.VzrzIzkBSYDEMwNb","ttl":86343,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}],"processes":[{"pid":5684,"ppid":0,"name":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe","command_line":"","sha256":"c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754","normalized_path":"C:\\c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754.exe","uid":"00000000-00005684","icon":"$58"},{"pid":5908,"ppid":5684,"name":"cmd.exe","command_line":"/k cmd < Doll & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00005684","uid":"00000000-00005908"},{"pid":5804,"ppid":5908,"name":"cmd.exe","command_line":"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005908","uid":"00000000-00005804"},{"pid":6032,"ppid":5804,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00005804","uid":"00000000-00006032"},{"pid":6036,"ppid":5804,"name":"findstr.exe","command_line":"findstr /I \"avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00005804","uid":"00000000-00006036"},{"pid":6028,"ppid":5804,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00005804","uid":"00000000-00006028"},{"pid":6140,"ppid":5804,"name":"findstr.exe","command_line":"findstr /I \"wrsa.exe\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00005804","uid":"00000000-00006140"},{"pid":6120,"ppid":5804,"name":"cmd.exe","command_line":"cmd /c mkdir 31469","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005804","uid":"00000000-00006120"},{"pid":4316,"ppid":5804,"name":"cmd.exe","command_line":"cmd /c copy /b Power + Team + Crime + Now + Process 31469\\Hardcover.pif","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005804","uid":"00000000-00004316"},{"pid":6016,"ppid":5804,"name":"cmd.exe","command_line":"cmd /c copy /b Guru + Retirement 31469\\E","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005804","uid":"00000000-00006016"},{"pid":5128,"ppid":5804,"name":"Hardcover.pif","command_line":"31469\\Hardcover.pif 31469\\E","sha256":"f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3","normalized_path":"%TEMP%\\7ZipSfx.000\\31469\\Hardcover.pif","parent_uid":"00000000-00005804","uid":"00000000-00005128"},{"pid":4244,"ppid":5804,"name":"PING.EXE","command_line":"ping -n 5 localhost","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00005804","uid":"00000000-00004244"},{"pid":3772,"ppid":0,"name":"jsc.exe","command_line":"","sha256":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569","normalized_path":"%TEMP%\\7ZipSfx.000\\31469\\jsc.exe","uid":"00000000-00003772","icon":"$59"}],"all_imported_dlls":["lpk.dll","msctf.dll","uxtheme.dll","api-ms-win-crt-locale-l1-1-0.dll","apphelp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ntdll.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","wkscli.dll","samcli.dll","wbemcomn2.dll","winsta.dll","oleaut32.dll","ieframe.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ntdsapi.dll","nlaapi.dll","pnrpnsp.dll","KernelBase.dll","shlwapi.dll","api-ms-win-core-processthreads-l1-1-1.dll","normaliz.dll","srvcli.dll","comctl32.dll","api-ms-win-core-synch-l1-2-0.dll","dwmapi.dll","rpcss.dll","cryptbase.dll","rsaenh.dll","RpcRtRemote.dll","nsi.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","devobj.dll","userenv.dll","sspicli.dll","wbemprox.dll","psapi.dll","kernel32.dll","usp10.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mpr.dll","wbemsvc.dll","winmm.dll","msvcrt.dll","imm32.dll","ucrtbase.dll","profapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","bcrypt.dll","ws2_32.dll","msvcp140.dll","user32.dll","fltLib.dll","api-ms-win-core-file-l1-2-0.dll","advapi32.dll","Wldap32.dll","cfgmgr32.dll","api-ms-win-crt-environment-l1-1-0.dll","propsys.dll","version.dll","wininet.dll","secur32.dll","winbrand.dll","framedynos.dll","netapi32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","setupapi.dll","dbghelp.dll","fastprox.dll","IPHLPAPI.DLL","dnsapi.dll","rpcrt4.dll","VxSSL32.dll","clbcatq.dll","netutils.dll","cryptsp.dll","winnsi.dll","comdlg32.dll","winrnr.dll","ole32.dll","iertutil.dll","wmiutils.dll","wsock32.dll","shell32.dll","api-ms-win-crt-heap-l1-1-0.dll","basebrd.dll","NapiNSP.dll","mswsock.dll","gdi32.dll","api-ms-win-core-file-l2-1-0.dll","sechost.dll","rasadhlp.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntmarta.dll","urlmon.dll","wship6.dll","vcruntime140.dll","wow64win.dll","msvcp_win.dll","cldapi.dll","edputil.dll","winmmbase.dll","imagehlp.dll","CoreMessaging.dll","wow64cpu.dll","Windows.StateRepositoryPS.dll","combase.dll","win32u.dll","SHCore.dll","msIso.dll","powrprof.dll","aepic.dll","wow64.dll","gdi32full.dll","bcryptprimitives.dll","windows.storage.dll","OneCoreUAPCommonProxyStub.dll","wbemcomn.dll","kernel.appcore.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Retirement","sha256":"d8baf0ae6626a5bcfd73f382c2da707110240f90662366a06da2a70b1d0b5d32","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Now","sha256":"608dc4fda08fab0bd071e34e2da768867d22aaaec8bff097ca6d001acbdb1505","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Power","sha256":"367a99acc640a280aec570df67a92b4209e21bbeddee9366a2e1892080d43ab1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Guru","sha256":"82d99e3115738e8a09ab9b016c859e1b29cda5aac51bb932097065328a34d5c0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Doll","sha256":"b6a84d79f7f2ac45f200d066ceb3b77c5d4189f43337bc0a13fa94181b2d052b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"64f17f88a4a48c8d23c74431b3d035e8e8751152de7bd86ddf9feba6bcafdc33","sha256":"64f17f88a4a48c8d23c74431b3d035e8e8751152de7bd86ddf9feba6bcafdc33","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Process","sha256":"6c9e201df66b802384613b2f30588fbae26ca9477e965c7d1808c644fd1e67d9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Team","sha256":"7c5f4bed4f2215fcfd80cd10795aaad8c75fe2d11e2815a767fee616eba91796","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Crime","sha256":"b070bc89be88b36ffad825e6841def9c793ce0f492dccbf7315f4a75ead15ee3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Hardcover.pif","sha256":"f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"jsc.exe","sha256":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"name":"DISMHOST.EXE.6AA0B002.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"name":"E","sha256":"95faa1d5e2ffbe3df9398f60ec9531e57aa2543377b583b0a1936297739f2801","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"dism.log","sha256":"063523bcf3dd387788abb9a5c95ea8838824366fdc3d92ceab5799be8d1422e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]}],"files_written":[{"path":"%TEMP%\\7ZipSfx.000","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Crime","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Doll","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Guru","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Now","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Power","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Process","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Retirement","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\Team","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\31469\\Hardcover.pif","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"path":"%TEMP%\\7ZipSfx.000\\31469\\E","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"path":"%TEMP%\\7ZipSfx.000\\31469\\jsc.exe","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"path":"%TEMP%\\7ZipSfx.000\\31249\\Hardcover.pif","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"path":"%TEMP%\\7ZipSfx.000\\31249\\E","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"},{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa087733821739bbd08be0f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Local\\SM0:7620:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Local\\SM0:7620:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"SM0:7620:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"SM0:7928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]},{"name":"SM0:6524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65abb48a2c40a0f71f08ec14"}]}]}},"report_ids":{"sandbox_job_ids":["6aa087733821739bbd08be0f","65abb48a2c40a0f71f08ec14"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Packed.7zip Sample c70a6bb61af3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c70a6bb61af3…. Malware family: Packed.7zip. Threat score 100/100. 13/24 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754"}],["$","meta","4",{"property":"og:title","content":"Malicious Packed.7zip Sample c70a6bb61af3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c70a6bb61af3…. Malware family: Packed.7zip. Threat score 100/100. 13/24 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c70a6bb61af33042ad6131ed456847c36ddf8a20cfd711646d2f673ec851c754"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Packed.7zip Sample c70a6bb61af3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c70a6bb61af3…. Malware family: Packed.7zip. Threat score 100/100. 13/24 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5a","11",{}]]