26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ab,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious HEUR/AGEN.1252166 Sample cb2a011220c6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cb2a011220c6…. Malware family: HEUR/AGEN.1252166. Threat score 100/100. 2/28 AV engines flagged this file. 18 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8","keywords":["Malicious","HEUR/AGEN.1252166","malware analysis","sandbox report","threat intelligence","cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8"],"about":{"@type":"SoftwareApplication","name":"b1cb7cbd1ce5e480d7d72826fe849297.exe","applicationCategory":["peexe","executable"],"identifier":"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"HEUR/AGEN.1252166","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T405,".exe" called "FindResourceA" with parameter "19534668" - (UID: 00000000-00006020) ".exe" called "FindResourceA" with parameter "12187792" - (UID: 00000000-00006020) ".exe" called "FindResourceA" with parameter "19534536" - (UID: 00000000-00006020) ".exe" called "FindResourceA" (UID: 00000000-00006020) ".exe" called "FindResourceA" with parameter "19534544" - (UID: 00000000-00006020) ".exe" called "FindResourceA" with parameter "19534572" - (UID: 00000000-00006020) ".exe" called "FindResourceA" with parameter "19534584" - (UID: 00000000-00006020) ".exe" called "FindResourceA" with parameter "19534600" - (UID: 00000000-00006020) "un556351.exe" called "FindResourceA" with parameter "18748236" - (UID: 00000000-00007960) "un556351.exe" called "FindResourceA" with parameter "6094012" - (UID: 00000000-00007960) "un556351.exe" called "FindResourceA" with parameter "18748104" - (UID: 00000000-00007960)28:T66a,Observed string: "$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) . System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application." (Indicator: "OpenProcessToken") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "OpenProcessToken" (Indicator: "OpenProcessToken") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "OpenProcessTokenW" (Indicator: "OpenProcessToken") in Source: 00000000-00007684-00000C1E-77029872 Observed string: "$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) ." (Indicator: "OpenProcessToken") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "OpenProcessToken" (Indicator: "OpenProcessToken") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp29:T498,Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00007684-00000C1E-74879365 Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00007684-00000C1E-74905051 Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp2a:T18f0,".exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006020) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006020) "un556351.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007960) "un556351.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007960) "pro1531.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007684) "pro1531.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000008264863503d79a6fd003f30258d1f3029cd1f30250089b6fe61ce958feffffffacd1f302b30f9a6f38d1f302226486350000876ffeffffff1a109a6f0200000000000000000000000000000040d1f302 (UID: 00000000-00007684) "pro1531.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007684) "pro1531.exe" called "RtlGetVersion" (UID: 00000000-00007684) "qu4639.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002956) "qu4639.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000dd877d9403d79a6f8801d10210cfd10254cfd10250089b6f71e030f9feffffff64cfd102b30f9a6ff0ced1027d867d940000876ffeffffff1a109a6f02000000000000000000000000000000f8ced102 (UID: 00000000-00002956) "qu4639.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002956)2b:Tdca,Observed string: "" (Indicator: ""set") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""set") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp2c:T588,Observed string: "" (Indicator: ""ver") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""ver") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp2d:T48d,"si275471.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "si275471.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "si275471.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "si275471.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "si275471.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "si275471.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "si275471.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "si275471.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "si275471.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")2e:Tec7,"pro1531.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007684-00000C15-76573754 "pro1531.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007684-00000C15-77225870 "qu4639.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00002956-00000C15-87393836 "qu4639.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00002956-00000C15-87785356 "si275471.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\si275471.exe" at 00000000-00003048-00000C15-95423839 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003048-00000C15-96730318 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll" at 00000000-00003048-00000C15-97028113 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00000000-00003048-00000C15-97248266 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003048-00000C15-97947589 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003048-00000C15-98676926 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003048-00000C15-98693845 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003048-00000C15-98694057 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00003048-00000C15-106342039 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00003048-00000C15-106366722 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00003048-00000C15-106776001 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00003048-00000C15-114119997 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00003048-00000C15-114185774 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00003048-00000C15-115066159 "si275471.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00003048-00000C15-1151414642f:T531,"si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "si275471.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER")30:T62c,".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006020) "un556351.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007960) "un556351.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007960) "un556351.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007960) "un556351.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007960) "un556351.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007960) "pro1531.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007684) "pro1531.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007684)31:T1034,Observed string: "CreateProcessA" (Indicator: "CreateProcess") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.02D30000.00000004.mdmp Observed string: "ElevateCreateProcess WRPMitigation ApplicationMonitor" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.02D30000.00000004.mdmp Observed string: "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.04DB0000.00000004.mdmp 00000000-00002956.00000000.78748.04F60000.00000004.mdmp 00000000-00002956.00000000.78748.05110000.00000004.mdmp 00000000-00002956.00000000.78748.0516D000.00000004.mdmp 00000000-00002956.00000000.78748.05390000.00000004.mdmp 00000000-00002956.00000000.78748.06D30000.00000004.mdmp 00000000-00002956.00000000.78748.070A0000.00000004.mdmp 00000000-00002956.00000000.78748.07470000.00000004.mdmp Observed string: "levateCreateProcess" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00002956.00000000.78748.0516D000.00000004.mdmp Observed string: "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.00FB0000.00000004.mdmp Observed string: "ElevateCreateProcess WRPMitigation ApplicationMonitor" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.00FB0000.00000004.mdmp Observed string: "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.030C0000.00000004.mdmp 00000000-00003048.00000000.79401.03360000.00000004.mdmp 00000000-00003048.00000000.79401.036C0000.00000004.mdmp 00000000-00003048.00000000.79401.03890000.00000004.mdmp Observed string: "levateCreateProcess" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "CreateProcess") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00006020.00000000.77910.00BC0000.00000004.mdmp 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.00BC0000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess") in Source: 00000000-00006020.00000000.77910.010E0000.00000004.mdmp 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.010E0000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp32:Ta0c,Observed string: "CreateFile" (Indicator: "CreateFile") in Source: 00000000-00003048-00000C1E-98442939 Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "CreateFileW" (Indicator: "CreateFile") in Source: 00000000-00003048-00000C1E-98443060 Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "CreateFileW" (Indicator: "CreateFile") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "CreateFile") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp33:Tcde,Observed string: "RegCreateKeyExA" (Indicator: "RegCreateKey") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "RegCreateKeyExA" (Indicator: "RegCreateKey") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "RegCreateKey") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp34:Tb6a,Observed string: "MoveFileA" (Indicator: "MoveFile") in Source: pro1531.exe.1873293397 Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "MoveFile") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp35:T982,Observed string: "$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) . System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application." (Indicator: "OpenProcess") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00007684-00000C1E-74940930 Observed string: "OpenProcess" (Indicator: "OpenProcess") in Source: 00000000-00007684-00000C1E-77031524 Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "OpenProcessTokenW" (Indicator: "OpenProcess") in Source: 00000000-00007684-00000C1E-77029872 Observed string: "OpenProcessW" (Indicator: "OpenProcess") in Source: 00000000-00007684-00000C1E-77031629 Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) ." (Indicator: "OpenProcess") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp36:T578,Observed string: "GetLastError" (Indicator: "GetLastError") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00007684-00000C1E-74944334 Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp37:T445,Observed string:"CloseHandle" that closes an open object handle. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"CreateFile" that creates/opens a file or I/O device. [Source: 00000000-00003048-00000C1E-98442939] Observed string:"CreateFileA" that creates/opens a file or I/O device. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"CreateFileW" that creates/opens a file or I/O device. [Source: 00000000-00003048-00000C1E-98443060] Observed string:"EnumResourceTypesA" that enumerates resource types within a binary module. [Source: pro1531.exe.1873293397] Observed string:"LoadResource" that retrieves a resource handle. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"ReadFile" that reads data from a file or I/O device. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"ReadFileAsText" that reads data from a file or I/O device. [Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp]38:T469,".exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 736c0000 ".exe" loaded module "NTDLL.DLL" at base 77bd0000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73fd0000 "un556351.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ea0000 "un556351.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ea0000 "un556351.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ea0000 "un556351.exe" loaded module "KERNEL32" at base 77a80000 "un556351.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 736c0000 "un556351.exe" loaded module "NTDLL.DLL" at base 77bd0000 "un556351.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73fd0000 "pro1531.exe" loaded module "MSIMG32.DLL" at base 73a70000 "pro1531.exe" loaded module "KERNEL32.DLL" at base 77a80000 "pro1531.exe" loaded module "OLE32.DLL" at base 76c50000 "pro1531.exe" loaded module "OLEAUT32.DLL" at base 75150000 "pro1531.exe" loaded module "MSVCR100.DLL" at base 6f8d0000 "pro1531.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 6fb5000039:T513,"pro1531.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "pro1531.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "si275471.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "si275471.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "si275471.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "si275471.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "si275471.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "si275471.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "si275471.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")3a:Tc48,"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "qu4639.exe" file has an entrypoint instructions - "call 0x407344,jmp 0x4041bc,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x41d008],je 0x404359,inc ecx,cmp ecx, 0x2d,jb 0x40433d,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x404362,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x41d00c],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x406f8d,test eax, eax,jne 0x404384,mov eax, 0x41d170,ret ,add eax, 8,ret ,call 0x406f8d," "un556351.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "pro1531.exe" file has an entrypoint instructions - "call 0x407344,jmp 0x4041bc,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x41d008],je 0x404359,inc ecx,cmp ecx, 0x2d,jb 0x40433d,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x404362,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x41d00c],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x406f8d,test eax, eax,jne 0x404384,mov eax, 0x41d170,ret ,add eax, 8,ret ,call 0x406f8d," "si275471.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],popal ,add byte ptr [ebp], dh,je 0x41b58a,outsd dx, dword ptr [esi],add byte ptr [esi], ah,imul eax, dword ptr [eax], 0x6c006c,push eax,add byte ptr [edx], dh,outsd dx, dword ptr [esi],add byte ptr [esi], ah,imul eax, dword ptr [eax], 0x65006c,jae 0x41b5a4,push esp,add byte ptr [edi], ch,je 0x41b5aa,popal ,add byte ptr [eax + eax + 0x20], ch,add byte ptr [edi], ch,add byte ptr [eax], ah,add byte ptr [edx], dl,inc ecx,add byte ptr [ebp], cl,push esi,add byte ptr [eax], dl,inc ebp,add byte ptr [esi], ch,je 0x41b5c6,imul eax, dword ptr [eax], 0x790074,xor dword ptr [eax], eax,xor al, byte ptr [eax],dec esi,add byte ptr [eax], al,add byte ptr [ecx], al,jo 0x41b5d8,jo 0x41b5da,inc esp,add byte ptr [ecx], ah,je 0x41b5e0,popal ,"3b:T500,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "un556351.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "un556351.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "un556351.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pro1531.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "pro1531.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "pro1531.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pro1531.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "qu4639.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "qu4639.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "qu4639.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qu4639.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3c:Ta25,Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00003048-00000C1E-106866382 Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "LoadLibraryEx" (Indicator: "LoadLibrary") in Source: 00000000-00003048-00000C1E-96650681 Observed string: "LoadLibraryExA" (Indicator: "LoadLibrary") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00003048-00000C1E-96181803 Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: 00000000-00003048-00000C1E-96211591 Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp 00000000-00002956.00000000.78748.07290000.00000004.mdmp 00000000-00002956.00000000.78748.08750000.00000004.mdmp 00000000-00002956.00000000.78748.09D90000.00000004.mdmp 00000000-00002956.00000000.78748.09E60000.00000004.mdmp Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp 00000000-00002956.00000000.78748.08750000.00000004.mdmp 00000000-00002956.00000000.78748.09D90000.00000004.mdmp 00000000-00002956.00000000.78748.09E60000.00000004.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "LoadLibraryExA" (Indicator: "LoadLibrary") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp3d:T47b,"qu4639.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qu4639.exe]- [targetUID: 00000000-00002956] "un556351.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\un556351.exe]- [targetUID: 00000000-00006020] "pro1531.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\pro1531.exe]- [targetUID: 00000000-00007960] "si275471.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP000.TMP\si275471.exe]- [targetUID: 00000000-00006020] "pro1531.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\pro1531.exe.log]- [targetUID: 00000000-00007684] "qu4639.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\qu4639.exe.log]- [targetUID: 00000000-00002956] "si275471.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\si275471.exe.log]- [targetUID: 00000000-00003048]3e:T825,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\CABINET.DLL" ".exe" trying to access non-existent file "C:\VERSION.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\UN556351.EXE" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\un556351.exe" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\SI275471.EXE" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\si275471.exe" "un556351.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\PRO1531.EXE" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\pro1531.exe" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QU4639.EXE" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qu4639.exe" "pro1531.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "pro1531.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "pro1531.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\MSIMG32.DLL" "pro1531.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\msimg32.dll"3f:T65d,".exe" trying to access non-existent file "C:\CB2A011220C6050942B327244C7B3DF1B0652C9CF1C18B64F71D2B08B654E6C8.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\UN556351.EXE.LOCAL" "un556351.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "pro1531.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "pro1531.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "pro1531.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\PRO1531.EXE.CONFIG" "pro1531.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "pro1531.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "pro1531.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PRO1531.EXE.LOG" "pro1531.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\pro1531.exe.config" "pro1531.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "pro1531.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "pro1531.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI"40:Tbfd,Observed string: "" (Indicator: ""copy") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "Copy" (Indicator: "copy") in Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp 00000000-00002956.00000000.78748.08750000.00000004.mdmp 00000000-00002956.00000000.78748.09D90000.00000004.mdmp 00000000-00002956.00000000.78748.09E60000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""copy") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp41:T50a,Observed string: "$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) . System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application." (Indicator: "net file") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "%TEMP%\rary Internet Files\*" (Indicator: "net file") in Source: 00000000-00003048-00000C20-35753630057 Observed string: "$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) ." (Indicator: "net file") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp42:T2669,Heuristic match: "$>.mZ" Heuristic match: "8{Q.sV" Heuristic match: ";f.lt" Heuristic match: "]_hw.Do" Heuristic match: "C%.TW" Heuristic match: "KB.TP" Pattern match: "api.ip.sb/ip" Heuristic match: "wA.lC" Heuristic match: "xJ.tR" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Heuristic match: "1l![.gR" Heuristic match: "ileStream.IO" Heuristic match: "el.Co" Pattern match: "IXP000.TMP/si275471.exe" Heuristic match: "Runtime type=System.Se" Heuristic match: "4.0.tW" Pattern match: "http://tempuri.org/" Pattern match: "http://schemas.xmlsoap.org/soap/actor/next" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/ultimateReceiver" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/next" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://schemas.microsoft.com/ws/2005/05/envelope/none" Pattern match: "http://schemas.microsoft.com/ws/2005/05/addressing/none" Pattern match: "http://www.w3.org/2005/08/addressing" Pattern match: "http://www.w3.org/2005/08/addressing/anonymous" Pattern match: "http://www.w3.org/2005/08/addressing/none" Pattern match: "http://www.w3.org/2005/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/soap/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/reply" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm" Pattern match: "http://schemas.microsoft.com/ws/2006/05/rm" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty" Pattern match: "http://schemas.microsoft.com/2005/12/ServiceModel/Addressing/Anonymous" Pattern match: "http://schemas.microsoft.com/2005/12/ServiceModel/Addressing/None" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "http://schemas.microsoft.com/2011/02/session/onopen" Pattern match: "http://tempuri.org/Entity/" Pattern match: "http://tempuri.org/Entity/Id1" Pattern match: "http://tempuri.org/Entity/Id1Response" Pattern match: "http://tempuri.org/Entity/Id2" Pattern match: "http://tempuri.org/Entity/Id2Response" Pattern match: "http://tempuri.org/Entity/Id3" Pattern match: "http://tempuri.org/Entity/Id3Response" Pattern match: "http://tempuri.org/Entity/Id4" Pattern match: "http://tempuri.org/Entity/Id4Response" Pattern match: "http://tempuri.org/Entity/Id5" Pattern match: "http://tempuri.org/Entity/Id5Response" Pattern match: "http://tempuri.org/Entity/Id6" Pattern match: "http://tempuri.org/Entity/Id6Response" Pattern match: "http://tempuri.org/Entity/Id7" Pattern match: "http://tempuri.org/Entity/Id7Response" Pattern match: "http://tempuri.org/Entity/Id8" Pattern match: "http://tempuri.org/Entity/Id8Response" Pattern match: "http://tempuri.org/Entity/Id9" Pattern match: "http://tempuri.org/Entity/Id9Response" Pattern match: "http://tempuri.org/Entity/Id10" Pattern match: "http://tempuri.org/Entity/Id10Response" Pattern match: "http://tempuri.org/Entity/Id11" Pattern match: "http://tempuri.org/Entity/Id11Response" Pattern match: "http://tempuri.org/Entity/Id12" Pattern match: "http://tempuri.org/Entity/Id12Response" Pattern match: "http://tempuri.org/Entity/Id13" Pattern match: "http://tempuri.org/Entity/Id13Response" Pattern match: "http://tempuri.org/Entity/Id14" Pattern match: "http://tempuri.org/Entity/Id14Response" Pattern match: "http://tempuri.org/Entity/Id15" Pattern match: "http://tempuri.org/Entity/Id15Response" Pattern match: "http://tempuri.org/Entity/Id16" Pattern match: "http://tempuri.org/Entity/Id16Response" Pattern match: "http://tempuri.org/Entity/Id17" Pattern match: "http://tempuri.org/Entity/Id17Response" Pattern match: "http://tempuri.org/Entity/Id18" Pattern match: "http://tempuri.org/Entity/Id18Response" Pattern match: "http://tempuri.org/Entity/Id19" Pattern match: "http://tempuri.org/Entity/Id19Response" Pattern match: "http://tempuri.org/Entity/Id20" Pattern match: "http://tempuri.org/Entity/Id20Response" Pattern match: "http://tempuri.org/Entity/Id21" Pattern match: "http://tempuri.org/Entity/Id21Response" Pattern match: "http://tempuri.org/Entity/Id22" Pattern match: "http://tempuri.org/Entity/Id22Response" Pattern match: "http://schemas.microsoft.com/2003/10/Serialization/Arrays" Pattern match: "http://schemas.microsoft.com/2003/10/Serialization/" Pattern match: "http://www.w3.org/2001/XMLSchema" Pattern match: "http://microsoft.com/wsdl/types/" Heuristic match: "Windows\Microsoft.NA" Heuristic match: "mouse.sy"43:T702,".exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00006020) ".exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006020) "un556351.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00007960) "un556351.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007960) "pro1531.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007684) "pro1531.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007684) "pro1531.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007684)44:T7f2,Observed string:"CreateToolhelp32Snapshot" [Source: 00000000-00007684-00000C1E-74879511] Observed string:"EnumProcessModules" [Source: 00000000-00007684-00000C1E-77074839] Observed string:"EnumProcessModulesW" [Source: 00000000-00007684-00000C1E-77074980] Observed string:"GetProcessesByName" [Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp] Observed string:"CreateToolhelp32Snapshot" [Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp] Observed string:"at Microsoft.Win32.NativeMethods.EnumProcessModules(SafeProcessHandle handle, IntPtr modules, Int32 size, Int32& needed)" [Source: 00000000-00002956.00000000.78748.05740000.00000002.mdmp 00000000-00002956.00000000.78748.07750000.00000004.mdmp 00000000-00002956.00000000.78748.0AC02000.00000004.mdmp] Observed string:"GetProcessesByName" [Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp 00000000-00002956.00000000.78748.08750000.00000004.mdmp 00000000-00002956.00000000.78748.09D90000.00000004.mdmp 00000000-00002956.00000000.78748.09E60000.00000004.mdmp] Observed string:"EnumProcessModules" [Source: 00000000-00002956.00000000.78748.07750000.00000004.mdmp] Observed string:"at Microsoft.Win32.NativeMethods.EnumProcessModules(SafeProcessHandle handle, IntPtr modules, Int32 size, Int32& needed)" [Source: 00000000-00003048.00000000.79401.03AB0000.00000002.mdmp] Observed string:"CreateToolhelp32Snapshot" [Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp] Observed string:"at Microsoft.Win32.NativeMethods.EnumProcessModules(SafeProcessHandle handle, IntPtr modules, Int32 size, Int32& needed)" [Source: 00000000-00007684.00000000.78037.0528E000.00000004.mdmp 00000000-00007684.00000000.78037.05860000.00000002.mdmp 00000000-00007684.00000000.78037.077F0000.00000004.mdmp]45:Tbd4,Observed string: "RegEnumKeyEx" (Indicator: "RegEnumKey") in Source: 00000000-00003048-00000C1E-110193472 Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00007684-00000C1E-75132376 Observed string: "RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: 00000000-00007684-00000C1E-77162430 Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00007684-00000C1E-75131086 Observed string: "RegQueryValueEx" (Indicator: "RegQueryValue") in Source: 00000000-00003048-00000C1E-96564947 Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00007684-00000C1E-75134907 Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "RegOpenKey") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp46:T841,Observed string: "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp 00000000-00002956.00000000.78748.07290000.00000004.mdmp 00000000-00002956.00000000.78748.08750000.00000004.mdmp 00000000-00002956.00000000.78748.09D90000.00000004.mdmp 00000000-00002956.00000000.78748.09E60000.00000004.mdmp Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp 00000000-00007684.00000000.78037.07460000.00000004.mdmp 00000000-00007684.00000000.78037.077F0000.00000004.mdmp 00000000-00007684.00000000.78037.09D70000.00000004.mdmp 00000000-00007684.00000000.78037.09E20000.00000004.mdmp47:Tddd,Observed string: "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00003048-00000C1E-98573353 Observed string: "GetFileVersionInfo" (Indicator: "GetFileVersionInfo") in Source: 00000000-00003048-00000C1E-110217600 Observed string: "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetFileVersionInfoSize" (Indicator: "GetFileVersionInfo") in Source: 00000000-00003048-00000C1E-110213635 Observed string: "GetFileVersionInfoSize" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00003048-00000C1E-110213635 Observed string: "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00007684-00000C1E-76696941 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00007684-00000C1E-76696941 Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00007684-00000C1E-76700651 Observed string: "GetSystemDirectory" (Indicator: "GetSystemDirectory") in Source: 00000000-00003048-00000C1E-116426629 Observed string: "GetSystemDirectoryA" (Indicator: "GetSystemDirectory") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 00000000-00003048-00000C1E-116426765 Observed string: "GetTempFileNameA" (Indicator: "GetTempFileName") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetTempPathA" (Indicator: "GetTempPath") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "GetSystemDirectoryA" (Indicator: "GetSystemDirectory") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetTempPathA" (Indicator: "GetTempPath") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetTempFileNameA" (Indicator: "GetTempFileName") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp48:T9f8,Observed string: "" (Indicator: ""dir") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "ON="Direct3DCreate9"/>" (Indicator: ""dir") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: ""dir") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp49:T6ea,Observed string: "DeleteFileA" (Indicator: "DeleteFileA") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "" (Indicator: "DeleteFileA") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "DeleteFileW") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "DeleteFileA") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "DeleteFileW") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "DeleteFileA") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "DeleteFileW") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "DeleteFileA" (Indicator: "DeleteFileA") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "" (Indicator: "DeleteFileA") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "DeleteFileW") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp4a:T730,Observed string: "RegDeleteValueA" (Indicator: "RegDeleteValue") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp Observed string: "RegDeleteValueA" (Indicator: "RegDeleteValue") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp Observed string: "" (Indicator: "RegDeleteValue") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp4b:T863,Observed string:"$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) . System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application." [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"AdjustTokenPrivileges" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"AdjustTokenPrivilegesW" [Source: 00000000-00007684-00000C1E-77030798] Observed string:"SeShutdownPrivilege" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"SeDebugPrivilege0.30319\ole32.dll" [Source: 00000000-00002956.00000000.78748.0516D000.00000004.mdmp] Observed string:"SeDebugPrivilege" [Source: 00000000-00002956.00000000.78748.07750000.00000004.mdmp] Observed string:"SeShutdownPrivilege" [Source: 00000000-00006020.00000000.77910.012A1000.00000020.mdmp 00000000-00006020.00000001.79827.012A1000.00000020.mdmp] Observed string:"$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) ." [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"AdjustTokenPrivileges" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"SeDebugPrivilege" [Source: 00000000-00007684.00000000.78037.0528E000.00000004.mdmp 00000000-00007684.00000000.78037.077F0000.00000004.mdmp]4c:T135c,Observed string:"AddAccessAllowedAce" which can Adds an access-allowed access control entry (ACE) to an access control list (ACL). [Source: 00000000-00007684-00000C1E-75637524] Observed string:"AllocateAndInitializeSid" which can Allocates and initializes a security identifier (SID) with up to eight subauthorities. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"AllocateAndInitializeSid" which can Initializes a security identifier (SID). [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"CheckTokenMembership" which can Determines whether a specified security identifier (SID) is enabled in an access token. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"EqualSid" which can Tests two security identifier (SID) values for equality. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"FreeSid" which can Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"GetTokenInformation" which can Retrieves a specified type of information about an access token. [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed string:"GetTokenInformationW" which can Retrieves a specified type of information about an access token. [Source: 00000000-00003048-00000C1E-115952017] Observed string:"InitializeAcl" which can Initializes a new ACL structure. [Source: 00000000-00007684-00000C1E-75637416] Observed string:"" which can Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. [Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp] Observed string:"" which can Sets the security of a file or directory object. [Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp] Observed string:"" which can Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. [Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp] Observed string:"" which can Sets the security of a file or directory object. [Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp] Observed string:"" which can Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. [Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp] Observed string:"" which can Sets the security of a file or directory object. [Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp 00000000-00006020.00000001.79827.01130000.00000004.mdmp] Observed string:"CheckTokenMembership" which can Determines whether a specified security identifier (SID) is enabled in an access token. [Source: 00000000-00006020.00000000.77910.012A1000.00000020.mdmp 00000000-00006020.00000001.79827.012A1000.00000020.mdmp] Observed string:"GetTokenInformation" which can Retrieves a specified type of information about an access token. [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"FreeSid" which can Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function. [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"AllocateAndInitializeSid" which can Allocates and initializes a security identifier (SID) with up to eight subauthorities. [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"AllocateAndInitializeSid" which can Initializes a security identifier (SID). [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"EqualSid" which can Tests two security identifier (SID) values for equality. [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp] Observed string:"" which can Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token. [Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp]4d:Taba,Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00007684-00000C1E-84207864 Observed string: "CorExitProcess_RetAddr" (Indicator: "ExitProcess") in Source: 00000000-00007684-00000C1E-84207979 Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp 00000000-00002956.00000000.78748.04E10000.00000004.mdmp Observed string: "@ ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00002956.00000000.78748.0513E000.00000040.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp 00000000-00006020.00000001.79827.012AA000.00000002.mdmp Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp 00000000-00007684.00000000.78037.05090000.00000040.mdmp 00000000-00007684.00000000.78037.05100000.00000004.mdmp Observed string: "@ ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00007684.00000000.78037.0526E000.00000040.mdmp4e:T6aa,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: un556351.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: un556351.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: un556351.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: un556351.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: un556351.exe]4f:T25cb,Found string "aWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBj" (Indicator: "rsa2"; in File: "00000000-00003048.00000000.79401.00BC2000.00000002.mdmp") Found string "base64str" (Indicator: "base64"; in File: "00000000-00003048.00000000.79401.00BC2000.00000002.mdmp") Found string "FromBase64" (Indicator: "base64"; in File: "00000000-00003048.00000000.79401.00BC2000.00000002.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; in File: "00000000-00003048.00000000.79401.00BC2000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; in File: "00000000-00003048.00000000.79401.00BC2000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "system.security.cryptography"; in File: "00000000-00003048.00000000.79401.00BC2000.00000002.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "rsacryptoserviceprovider"; in Source: "00000000-00002956.00000000.78748.0516D000.00000004.mdmp") Found string "mZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV0CmFpaWZibmJmb2JwbWVla2lwaGVlaWppbWRwbmxwZ3BwfFRlcnJhU3RhdGlvbgpmbm5lZ3BobG9iamRwa2hlY2Fwa2lqamRrZ2NqaGtpYnxIYXJtb255V2FsbGV0CmFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfENvaW45OFdhbGxldApjZ2Vlb2RwZmFnamNlZWZpZWZsbWRmcGhwbGtlbmxma3xUb25DcnlzdGFsCnBkYWRqa2ZrZ2NhZmdiY2VpbWNwYmthbG5mbmVwYm5rfEthcmRpYUNoYWluCmJmbmFlbG1vbWVpbWhscG1nam5qb3BoaHBra29sanBhfFBoYW50b20KZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8T3h5Z2VuCm1nZmZrZmJpZGloanBvYW9tYWpsYmdjaGRkbGljZ3BufFBhbGlXYWxsZXQKYW9ka2thZ25hZGNib2JmcGdnZm5qZW9uZ2VtamJqY2F8Qm9sdFgKa3Bmb3BrZWxtYXBjb2lwZW1mZW5kbWRjZ2huZWdpbW58TGlxdWFsaXR5V2FsbGV0CmhtZW9ibmZuZmNtZGtkY21sYmxnYWdtZnBmYm9pZWFmfFhkZWZpV2FsbGV0CmxwZmNiamtuaWpwZWVpbGxpZm5raWtnbmNpa2dmaGRvfE5hbWlXYWxsZXQKZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18TWFpYXJEZUZpV2FsbGV0CmJoZ2hvYW1hcGNkcGJvaHBoaWdvb29hZGRpbnBrYmFpfEF1dGhlbnRpY2F0b3IKb29ramxia2lpamluaHBtbmpmZmNvZmpvbmJmYmdhb2N8VGVtcGxlV2FsbGV0" (Indicator: "rsa2"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "system.security.cryptography"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "rsacryptoserviceprovider"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndaelmanaged"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; in Source: "00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp")50:T4ea,GetModuleHandleW@KERNEL32.DLL at 00000000-00006020-20579-4-012A2BFB GetModuleHandleW@KERNEL32.DLL at 00000000-00007960-23984-4-011E2BFB GetModuleHandleW@KERNEL32.DLL at 00000000-00007684-26948-14-0041046E GetModuleHandleW@KERNEL32.DLL at 00000000-00007684-26948-178-0041087E GetModuleHandleA@KERNEL32.DLL at 00000000-00007684-26948-59-004019F0 GetModuleHandleW@KERNEL32.DLL at 00000000-00007684-26948-10-0040E76A GetModuleHandleW@KERNEL32.DLL at 00000000-00007684-26948-32-004105D5 GetModuleHandleA@KERNEL32.DLL at 00000000-00007684-26948-582-00413610 GetModuleHandleW@KERNEL32.DLL at 00000000-00007684-26948-56-0040E7C3 GetModuleHandleW@KERNEL32.DLL at 00000000-00007684-26948-9-004104E9 GetModuleHandleW@KERNEL32.DLL at 00000000-00002956-31231-178-0041087E GetModuleHandleW@KERNEL32.DLL at 00000000-00002956-31231-56-0040E7C3 GetModuleHandleA@KERNEL32.DLL at 00000000-00002956-31231-815-00413610 GetModuleHandleW@KERNEL32.DLL at 00000000-00002956-31231-10-0040E76A GetModuleHandleA@KERNEL32.DLL at 00000000-00002956-31231-59-004019F0 GetModuleHandleW@KERNEL32.DLL at 00000000-00002956-31231-32-004105D5 GetModuleHandleW@KERNEL32.DLL at 00000000-00002956-31231-9-004104E9 GetModuleHandleW@KERNEL32.DLL at 00000000-00002956-31231-14-0041046E51:T4b4,".exe" wrote 32256 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\si275471.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "un556351.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\pro1531.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "un556351.exe" wrote 27136 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qu4639.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...52:T585,"0.0.0.0" Potential IP "1.0.0.0" found in string "" "95.13.44.97" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication" />", Potential IP "1.0.0.0" found in string "MyApplication.app version="1.0.0.0"C:\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\si275471.exe", Potential IP "4.0.0.0" found in string "ternals 4.0.0.0 31b", Potential IP "4.0.0.0" found in string "ystem.Xaml 4.0.0.0 b77a5c561934e089 MSIL", "193.233.20.33:4125", Potential IP "193.233.20.33" found in string "net.tcp://193.233.20.33:4125/", "193.233.20.33", "2.5.29.10", "2.5.29.19", "2.5.29.14", "2.5.29.15", "2.5.29.37", Potential IP "4.0.0.0" found in string "System.ServiceModel 4.0.0.0", Potential IP "5.1.0.0" found in string "wextract processorArchitecture="x86" type="win32" version="5.1.0.0"C:\cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.exe", Potential IP "1.3.167.21" found in string "?\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21", Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32 processorArchitecture="*" type="win32" version="5.1.0.0"C:\WINDOWS\WindowsShell.Manifest", Potential IP "5.1.0.0" found in string ".exe\" called \"LoadResource\" (UID: 00000000-00006020)\n \"un556351.exe\" called \"LoadResource\" (UID: 00000000-00007960)\n \"pro1531.exe\" called \"LoadResource\" (UID: 00000000-00007684)\n \"qu4639.exe\" called \"LoadResource\" (UID: 00000000-00002956)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\".exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP\\ (UID: 00000000-00006020)\n \"un556351.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP001.TMP\\ (UID: 00000000-00007960)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"FreeLibraryW\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003048-00000C1E-96650992\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00007960-00000C1E-73474829\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function \"MemoryStream\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProcA\" (Indicator: \"CallWindowProc\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp\n Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp\n Observed string: \"CallWindowProcA\" (Indicator: \"CallWindowProc\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp\n Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains reference to Base64 character set","description":"Observed string: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002956.00000000.78748.0513E000.00000040.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Observed string:\"IsDebuggerPresent\" [Source: 00000000-00007684-00000C1E-74942983]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string:\"SetUnhandledExceptionFilter\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"UnhandledExceptionFilter\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006020-20579-7-012A6CF0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007960-23984-7-011E6CF0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007684-26948-1093-004123F1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007684-26948-17-0040CE09\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007684-26948-591-00416F6A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007684-26948-16-0040E61C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002956-31231-1338-004123F1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002956-31231-824-00416F6A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002956-31231-17-0040CE09\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002956-31231-16-0040E61C\n SetUnhandledExceptionFilter@KERNEL32.dll at 45165-1813-00405FCA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed string:\"frombase64string\" [Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp\n 00000000-00002956.00000000.78748.08750000.00000004.mdmp\n 00000000-00002956.00000000.78748.09D90000.00000004.mdmp\n 00000000-00002956.00000000.78748.09E60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"FromBase64CharArray\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Observed string:\"CryptUnprotectData\" which can perform decryption and does an integrity check of the data. [Source: 00000000-00003048-00000C1E-116399272]\n Observed string:\"CryptUnprotectDataW\" which can perform decryption and does an integrity check of the data. [Source: 00000000-00003048-00000C1E-116399388]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-238","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed string:\"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" which can performs encryption on the data. [Source: 00000000-00002956.00000000.78748.0516D000.00000004.mdmp]\n Observed string:\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" which can performs encryption on the data. [Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp]\n Observed string:\"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" which can performs encryption on the data. [Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Observed string: \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp\n Observed string: \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Found RSA crypto related strings","description":"Observed string: \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\") in Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp\n 00000000-00002956.00000000.78748.08750000.00000004.mdmp\n 00000000-00002956.00000000.78748.09D90000.00000004.mdmp\n 00000000-00002956.00000000.78748.09E60000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Cryptographic Related","name":"Found decryption/decode related string","description":"Observed string:\"createdecryptor\" [Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp\n 00000000-00002956.00000000.78748.08750000.00000004.mdmp\n 00000000-00002956.00000000.78748.09D90000.00000004.mdmp\n 00000000-00002956.00000000.78748.09E60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"pro1531.exe\" called \"IsWow64Process\" (UID: 00000000-00007684)\n \"qu4639.exe\" called \"IsWow64Process\" with parameter \"2956\" - (UID: 00000000-00002956)\n \"si275471.exe\" called \"IsWow64Process\" with parameter \"3048\" - (UID: 00000000-00003048)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"pro1531.exe\" called \"GetActiveWindow\" (UID: 00000000-00007684)\n \"qu4639.exe\" called \"GetActiveWindow\" (UID: 00000000-00002956)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006020)\n \"un556351.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007960)\n \"pro1531.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007684)\n \"pro1531.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007684-26948-191-00412A15\n GetTickCount@KERNEL32.DLL at 00000000-00002956-31231-191-00412A15","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00006020-20579-23-012A2390\n FindFirstFileA@KERNEL32.DLL at 00000000-00007960-23984-23-011E2390","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00006020-20579-54-012A55A0\n GetDriveTypeA@KERNEL32.DLL at 00000000-00007960-23984-54-011E55A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information","description":"Observed function \"get_SystemDirectory\" in \"si275471.exe\"\n Observed function \"get_UserName\" in \"si275471.exe\"\n Observed function \"GetLogicalDrives\" in \"si275471.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00007960-00000C1E-73475655\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007684-26948-191-00412A15\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002956-31231-191-00412A15\n GetSystemTimeAsFileTime@KERNEL32.dll at 45165-1936-0041ACB4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007684-26948-191-00412A15\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002956-31231-191-00412A15\n GetSystemTimeAsFileTime@KERNEL32.dll at 45165-1936-0041ACB4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string:\"EnumSystemLocalesA\" [Source: pro1531.exe.1873293397]\n Observed string:\"EnumSystemLocalesEx\" [Source: 00000000-00003048-00000C1E-96303514]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00007684-00000C1E-74940705]\n Observed string:\"GetLocaleInfoEx\" [Source: 00000000-00007960-00000C1E-73477282]\n Observed string:\"GetLocaleInfoW\" [Source: pro1531.exe.1873293397]\n Observed string:\"GetUserDefaultLCID\" [Source: pro1531.exe.1873293397]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00006020-20579-4-012A2BFB\n GetVersionExA@KERNEL32.DLL at 00000000-00006020-20579-66-012A36EE\n GetVersionExA@KERNEL32.DLL at 00000000-00006020-20579-14-012A681F\n GetVersionExA@KERNEL32.DLL at 00000000-00007960-23984-66-011E36EE\n GetVersion@KERNEL32.DLL at 00000000-00007960-23984-4-011E2BFB\n GetVersionExA@KERNEL32.DLL at 00000000-00007960-23984-14-011E681F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00007684-26948-118-00417A20\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002956-31231-118-00417A20\n GetLocaleInfoW@KERNEL32.dll at 45165-672-004171FC\n GetLocaleInfoW@KERNEL32.dll at 45165-627-0041705E\n GetUserDefaultLCID@KERNEL32.dll at 45165-1907-0041704A\n EnumSystemLocalesA@KERNEL32.dll at 45165-620-00417579\n EnumSystemLocalesA@KERNEL32.dll at 45165-622-00417512\n GetLocaleInfoA@KERNEL32.dll at 45165-670-00417155\n EnumSystemLocalesA@KERNEL32.dll at 45165-1920-004174E6\n EnumSystemLocalesA@KERNEL32.dll at 45165-619-004175B5\n GetLocaleInfoA@KERNEL32.dll at 45165-677-00417428","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00006020-20579-52-012A597D\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00006020-20579-59-012A6952\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00007960-23984-59-011E6952\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00007960-23984-52-011E597D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string:\"GetDiskFreeSpaceA\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetDiskFreeSpaceA\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"un556351.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"un556351.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"pro1531.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"qu4639.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"si275471.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local/system time as file time (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00007960-00000C1E-73475655\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\") in Source: 00000000-00003048-00000C1E-96539945","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Observed string: \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: pro1531.exe.1873293397\n Observed string: \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetKeyboardLayoutList\"[Source: 00000000-00003048-00000C1E-118432559]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersion \" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetVersionExA \" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetVersionInfo \" [Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp]\n Observed string:\"VerSetConditionMask \" [Source: pro1531.exe.1873293397]\n Observed string:\"GetVersionInfo \" [Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp\n 00000000-00002956.00000000.78748.08750000.00000004.mdmp\n 00000000-00002956.00000000.78748.09D90000.00000004.mdmp\n 00000000-00002956.00000000.78748.09E60000.00000004.mdmp]\n Observed string:\"GetVersion \" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]\n Observed string:\"GetVersionExA \" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 00000000-00007684-00000C1E-74945062]\n Observed API string: \"GetStartupInfo\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string:\"GetVolumeInformation\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetVolumeInformation\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Observed string:\"FindFirstVolumeMountPointW\" [Source: pro1531.exe.1873293397]","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"si275471.exe\" issued a query \"SELECT * FROM Win32_DiskDrive\"\n \"si275471.exe\" issued a query \"$objects\"\n \"si275471.exe\" issued a query \"SELECT * FROM AntivirusProduct\"\n \"si275471.exe\" issued a query \"SELECT * FROM AntiSpyWareProduct\"\n \"si275471.exe\" issued a query \"SELECT * FROM FirewallProduct\"\n \"si275471.exe\" issued a query \"SELECT * FROM Win32_Process Where SessionId='1'\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007684-26948-377-0040ADB0\n GetProcessHeap@KERNEL32.DLL at 00000000-00007684-26948-563-00417EE1\n GetProcessHeap@KERNEL32.DLL at 00000000-00007684-26948-374-0040AE70\n GetProcessHeap@KERNEL32.DLL at 00000000-00002956-31231-610-0040ADB0\n GetProcessHeap@KERNEL32.DLL at 00000000-00002956-31231-796-00417EE1\n GetProcessHeap@KERNEL32.DLL at 00000000-00002956-31231-607-0040AE70","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"pro1531.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"qu4639.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"si275471.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"pro1531.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"qu4639.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"si275471.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"si275471.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Yandex (UID: 00000000-00003048)\n \"si275471.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Yandex\\YaAddon (UID: 00000000-00003048)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP000.TMP\\un556351.exe\" - (UID: 00000000-00006020)\n \"un556351.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP001.TMP\\pro1531.exe\" - (UID: 00000000-00007960)\n \"un556351.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP001.TMP\\qu4639.exe\" - (UID: 00000000-00007960)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"\".exe\" called \"GetProcAddress\" with a parameter FeClientInitialize (UID: 00000000-00006020)\n \".exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006020)\n \".exe\" called \"GetProcAddress\" with a parameter DelNodeRunDLL32 (UID: 00000000-00006020)\n \".exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006020)\n \"un556351.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007960)\n \"un556351.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007960)\n \"un556351.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007960)\n \"un556351.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007960)\n \"un556351.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007960)\n \"un556351.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007960)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.233.20.33:4125\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"wextract.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00006020-20579-1-012A6A60\n Sleep@KERNEL32.DLL at 00000000-00007960-23984-1-011E6A60\n Sleep@KERNEL32.DLL at 00000000-00007684-26948-76-00411D06\n Sleep@KERNEL32.DLL at 00000000-00007684-26948-36-00411CBA\n Sleep@KERNEL32.DLL at 00000000-00007684-26948-10-0040E76A\n Sleep@KERNEL32.DLL at 00000000-00007684-26948-52-00411C75\n Sleep@KERNEL32.DLL at 00000000-00007684-26948-147-00411D54\n Sleep@KERNEL32.DLL at 00000000-00002956-31231-52-00411C75\n Sleep@KERNEL32.DLL at 00000000-00002956-31231-10-0040E76A\n Sleep@KERNEL32.DLL at 00000000-00002956-31231-76-00411D06\n Sleep@KERNEL32.DLL at 00000000-00002956-31231-36-00411CBA\n Sleep@KERNEL32.DLL at 00000000-00002956-31231-147-00411D54\n Sleep@KERNEL32.dll at 45165-420-0040814C\n Sleep@KERNEL32.dll at 45165-422-00408266","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: un556351.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00006020-20579-65-012A17EE\n LoadLibraryA@KERNEL32.DLL at 00000000-00006020-20579-34-012A202A\n LoadLibraryA@KERNEL32.DLL at 00000000-00006020-20579-25-012A2F1D\n LoadLibraryExA@KERNEL32.DLL at 00000000-00006020-20579-33-012A6495\n LoadLibraryExA@KERNEL32.DLL at 00000000-00007960-23984-33-011E6495\n LoadLibraryA@KERNEL32.DLL at 00000000-00007960-23984-65-011E17EE\n LoadLibraryA@KERNEL32.DLL at 00000000-00007960-23984-25-011E2F1D\n LoadLibraryA@KERNEL32.DLL at 00000000-00007960-23984-34-011E202A\n LoadLibraryA@KERNEL32.DLL at 00000000-00007684-26948-13-00413B7E\n LoadLibraryA@KERNEL32.DLL at 00000000-00007684-26948-59-004019F0\n LoadLibraryA@KERNEL32.DLL at 00000000-00002956-31231-59-004019F0\n LoadLibraryA@KERNEL32.DLL at 00000000-00002956-31231-13-00413B7E\n LoadLibraryW@KERNEL32.dll at 45165-457-0040C010","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"\" (Indicator: \"WinExec\") in Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp\n Observed string: \"\" (Indicator: \"WinExec\") in Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp\n Observed string: \"\" (Indicator: \"WinExec\") in Source: 00000000-00006020.00000000.77910.01130000.00000004.mdmp\n 00000000-00006020.00000001.79827.01130000.00000004.mdmp\n Observed string: \"\" (Indicator: \"WinExec\") in Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed API string: \"CreateThread\" [Source: 00000000-00007960-00000C1E-73473807]\n Observed API string: \"CreateThread\" [Source: 00000000-00007960-00000C1E-73474381]\n Observed API string: \"CreateThread\" [Source: 00000000-00007960-00000C1E-73476852]\n Observed API string: \"CreateThread\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00007684-00000C1E-74941311\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp\n Observed string: \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\") in Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp\n 00000000-00002956.00000000.78748.08750000.00000004.mdmp\n 00000000-00002956.00000000.78748.09D90000.00000004.mdmp\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"%APPDATA%\\Opera Software\\*\" in Source: 00000000-00003048-00000C20-35796267702\n \"%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\*\" in Source: 00000000-00003048-00000C20-35879050343\n \"DSystem\\CurrentControlSet\\Control\\Session Manager\" in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n \"System\\CurrentControlSet\\Control\\Session Manager\" in Source: 18686-17-0040256D\n \"System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations\" in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:7684:168:WilStaging_02\"\n \"Local\\SM0:2956:168:WilStaging_02\"\n \"Local\\SM0:3048:168:WilStaging_02\"\n \"SM0:3048:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"si275471.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"si275471.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibraryA\" in \"si275471.exe\"\n Observed API \"GetProcAddress\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"LoadLibraryA\" in \"si275471.exe\"\n Observed unmanaged function \"GetProcAddress\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"pro1531.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6D060000\n \"qu4639.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6D060000\n \"si275471.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6D060000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"pro1531.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73980000\n \"qu4639.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73980000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"pro1531.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 6E470000\n \"qu4639.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 6E470000\n \"si275471.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 6E470000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DC0000\n \"un556351.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DC0000\n \"pro1531.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DC0000\n \"qu4639.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DC0000\n \"si275471.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A20000\n \"un556351.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A20000\n \"pro1531.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A20000\n \"qu4639.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A20000\n \"si275471.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$39","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"si275471.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"un556351.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"si275471.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","relevance":1,"id":"static-146","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\" has an executable section named \".text\"\n \"qu4639.exe\" has an executable section named \".text\"\n \"un556351.exe\" has an executable section named \".text\"\n \"pro1531.exe\" has an executable section named \".text\"\n \"si275471.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\" has an writable section named \".data\"\n \"qu4639.exe\" has an writable section named \".data\"\n \"un556351.exe\" has an writable section named \".data\"\n \"pro1531.exe\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3a","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x275a254\" greater than 0x100000\n Virtual size of \".data\" is \"0x274b954\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"un556351.exe\" (UID: 00000000-00007960) was launched with new environment variables: \"__COMPAT_LAYER=\"ElevateCreateProcess WRPMitigation\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"un556351.exe\" (UID: 00000000-00007960) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"un556351.exe\" (UID: 00000000-00007960)\n Spawned process \"pro1531.exe\" (UID: 00000000-00007684)\n Spawned process \"qu4639.exe\" (UID: 00000000-00002956)\n Spawned process \"si275471.exe\" (UID: 00000000-00003048)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"un556351.exe\" (UID: 00000000-00007960)\n Spawned process \"pro1531.exe\" (UID: 00000000-00007684)\n Spawned process \"qu4639.exe\" (UID: 00000000-00002956)\n Spawned process \"si275471.exe\" (UID: 00000000-00003048)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"pro1531.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\pro1531.exe.log\"\n \"qu4639.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\qu4639.exe.log\"\n \"si275471.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\si275471.exe.log\"\n \"pro1531.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\pro1531.exe.log\"\n \"qu4639.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\qu4639.exe.log\"\n \"si275471.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\si275471.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Observed string: \"WSAStartup\" (Indicator: \"WSAStartup\") in Source: 00000000-00003048-00000C1E-100410080","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"$40","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace \"System.Net.NetworkInformation\" in \"si275471.exe\"\n Observed namespace \"System.Net\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve local network connections","description":"$41","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.i\" [Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003048\"\n YARA signature for RC4 encryption matched on process \"00000000-00002956\"\n YARA signature for RC4 encryption matched on process \"00000000-00007684\"\n YARA signature for RC4 encryption matched on file \"qu4639.exe\"\n YARA signature for RC4 encryption matched on file \"pro1531.exe\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"pro1531.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007684)\n \"qu4639.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002956)\n \"si275471.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003048)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"si275471.exe\" called \"GetUserNameW\" (UID: 00000000-00003048)\n \"si275471.exe\" called \"GetUserNameExW\" (UID: 00000000-00003048)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screenshot","description":"Observed function \"System.Drawing.CopyFromScreen\" in \"si275471.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string:\"GetDriveTypeA\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetDriveTypeA\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileA\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"FindFirstFileW\" [Source: 00000000-00003048-00000C1E-107810402]\n Observed string:\"FindNextFileA\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"FindNextFileW\" [Source: 00000000-00003048-00000C1E-108695638]\n Observed string:\"FindFirstFileA\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]\n Observed string:\"FindNextFileA\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string:\"GetLogicalDrives\" [Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp]\n Observed string:\"GetLogicalDrives\" [Source: 00000000-00002956.00000000.78748.07290000.00000004.mdmp\n 00000000-00002956.00000000.78748.08750000.00000004.mdmp\n 00000000-00002956.00000000.78748.09D90000.00000004.mdmp\n 00000000-00002956.00000000.78748.09E60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Observed interface string:\"InterlockedExchange\" [Source: pro1531.exe.1873293397]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"ExpandEnvironmentStrings\" [Source: 00000000-00003048-00000C1E-107809073]\n Observed string:\"ExpandEnvironmentStringsA\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"ExpandEnvironmentStringsW\" [Source: 00000000-00003048-00000C1E-107809445]\n Observed string:\"GetNativeSystemInfo\" [Source: 00000000-00007684-00000C1E-75715347]\n Observed string:\"GetSystemInfo\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"NtQuerySystemInformation\" [Source: 00000000-00003048-00000C1E-96539711]\n Observed string:\"NtQuerySystemInformationW\" [Source: 00000000-00003048-00000C1E-109602070]\n Observed string:\"ExpandEnvironmentStringsA\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]\n Observed string:\"GetSystemInfo\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetModuleFileName\" [Source: pro1531.exe.1873293397]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string:\"GetEnvironmentVariable\" [Source: 00000000-00003048-00000C1E-106410908]\n Observed string:\"GetEnvironmentVariableW\" [Source: 00000000-00003048-00000C1E-96118356]\n Observed string:\"GetEnvironmentVariableW\" [Source: 00000000-00003048.00000000.79401.05450000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed string:\"GetUserName\" [Source: 00000000-00003048-00000C1E-106334336]\n Observed string:\"GetUserNameEx\" [Source: 00000000-00003048-00000C1E-106761543]\n Observed string:\"GetUserNameExW\" [Source: 00000000-00003048-00000C1E-106761684]\n Observed string:\"GetUserNameW\" [Source: 00000000-00003048-00000C1E-106334439]\n Observed string:\"LookupAccountName\" [Source: 00000000-00003048-00000C1E-106766023]\n Observed string:\"LookupAccountNameW\" [Source: 00000000-00003048-00000C1E-106766142]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"GetSystemMetrics\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00007960-00000C1E-73475318\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00002956.00000000.78748.00400000.00000040.mdmp\n 00000000-00002956.00000000.78748.04DC0000.00000040.mdmp\n 00000000-00002956.00000000.78748.04E10000.00000004.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00007684.00000000.78037.00400000.00000040.mdmp\n 00000000-00007684.00000000.78037.05090000.00000040.mdmp\n 00000000-00007684.00000000.78037.05100000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed string:\"DllGetClassObject\" [Source: 00000000-00007684-00000C1E-77154629]\n Observed string:\"DllGetClassObjectInternal\" [Source: 00000000-00007684-00000C1E-75522559]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed string:\"\" [Source: 00000000-00002956.00000000.78748.05110000.00000004.mdmp]\n Observed string:\"\" [Source: 00000000-00003048.00000000.79401.03360000.00000004.mdmp]\n Observed string:\"\" [Source: 00000000-00007684.00000000.78037.05240000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00006020.00000000.77910.012A1000.00000020.mdmp\n 00000000-00006020.00000001.79827.012A1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00003048-00000C20-34640517898\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00003048-00000C20-34713512907\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00003048-00000C20-34865480065\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00003048-00000C20-34994719555\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: qu4639.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: pro1531.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Observed string: \"CoGetObjectContext\" (Indicator: \"CoGetObject\") in Source: 00000000-00003048-00000C1E-106795052","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin]\n Observed string:\"ExitWindowsEx\" [Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\n Observed string: \"CreateMutexW\" (Indicator: \"CreateMutex\") in Source: pro1531.exe.1873293397\n Observed string: \"OpenMutexA\" (Indicator: \"OpenMutex\") in Source: pro1531.exe.1873293397\n Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: 00000000-00006020.00000000.77910.012AA000.00000002.mdmp\n 00000000-00006020.00000001.79827.012AA000.00000002.mdmp","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"qu4639.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\IXP001.TMP\\qu4639.exe]- [targetUID: 00000000-00002956]\n \"un556351.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\IXP000.TMP\\un556351.exe]- [targetUID: 00000000-00006020]\n \"pro1531.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\IXP001.TMP\\pro1531.exe]- [targetUID: 00000000-00007960]\n \"si275471.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\IXP000.TMP\\si275471.exe]- [targetUID: 00000000-00006020]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.bin\" was detected as \"Microsoft visual C++ 8\"\n \"qu4639.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"un556351.exe\" was detected as \"Microsoft visual C++ 8\"\n \"pro1531.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"pro1531.exe\" is allocating memory with PAGE_GUARD access rights\n \"qu4639.exe\" is allocating memory with PAGE_GUARD access rights\n \"si275471.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .data\n .rsrc\n .data\n .reloc with unusual entropies 7.92050660155\n 7.96947407678\n 7.88581800196\n 7.95174922753\n 0.0558553080537","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"$50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00006020-20579-55-012A5467\n GetSystemInfo@KERNEL32.DLL at 00000000-00007960-23984-55-011E5467","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00006020-20579-1-012A6A60\n GetStartupInfoW@KERNEL32.DLL at 00000000-00007960-23984-1-011E6A60\n GetStartupInfoA@KERNEL32.DLL at 00000000-00007684-26948-175-00411A15\n GetStartupInfoA@KERNEL32.DLL at 00000000-00002956-31231-175-00411A15\n GetStartupInfoW@KERNEL32.dll at 45165-1-00404329","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00006020-20579-14-012A681F\n GetSystemMetrics@USER32.DLL at 00000000-00007960-23984-14-011E681F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve volume information","description":"GetVolumeInformationA@KERNEL32.DLL at 00000000-00006020-20579-52-012A597D\n GetVolumeInformationA@KERNEL32.DLL at 00000000-00007960-23984-52-011E597D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-130","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"si275471.exe\" issued a query \"SELECT * FROM Win32_DiskDrive\"\n \"si275471.exe\" issued a query \"SELECT * FROM Win32_Process Where SessionId='1'\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/69 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00006020-20579-43-012A4FE0\n FindResourceA@KERNEL32.DLL at 00000000-00006020-20579-63-012A2CAA\n LoadResource@KERNEL32.DLL at 00000000-00006020-20579-49-012A6298\n FindResourceA@KERNEL32.DLL at 00000000-00006020-20579-27-012A468F\n FindResourceA@KERNEL32.DLL at 00000000-00006020-20579-50-012A6517\n FindResourceA@KERNEL32.DLL at 00000000-00007960-23984-63-011E2CAA\n FindResourceA@KERNEL32.DLL at 00000000-00007960-23984-50-011E6517\n LoadResource@KERNEL32.DLL at 00000000-00007960-23984-49-011E6298\n FindResourceA@KERNEL32.DLL at 00000000-00007960-23984-27-011E468F\n FindResourceA@KERNEL32.DLL at 00000000-00007960-23984-43-011E4FE0\n FindResourceA@KERNEL32.DLL at 00000000-00007684-26948-59-004019F0\n FindResourceA@KERNEL32.DLL at 00000000-00002956-31231-59-004019F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"qu4639.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\IXP001.TMP\\qu4639.exe]- [targetUID: 00000000-00002956]\n \"un556351.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\IXP000.TMP\\un556351.exe]- [targetUID: 00000000-00006020]\n \"pro1531.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\IXP001.TMP\\pro1531.exe]- [targetUID: 00000000-00007960]\n \"si275471.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\IXP000.TMP\\si275471.exe]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")\n \"un556351.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"un556351.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP1\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP001.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$51","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$52","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"api-ms-win-base-bootconfig-l1-1-0\" (Indicator: \"bootconfig\")\n \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")\n \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"si275471.exe\" had access to \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Type: \"FileHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\si275471.exe\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\un556351.exe\" for deletion\n \"un556351.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\qu4639.exe\" for deletion\n \"un556351.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\pro1531.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\si275471.exe\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\un556351.exe\" with delete access\n \"un556351.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\" with delete access\n \"un556351.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\" with delete access\n \"un556351.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\qu4639.exe\" with delete access\n \"un556351.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\pro1531.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"qu4639.exe\" claimed CRC 439564 while the actual is CRC 717026\n \"un556351.exe\" claimed CRC 621287 while the actual is CRC 439564\n \"pro1531.exe\" claimed CRC 362014 while the actual is CRC 621287","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegCreateKeyExA\n RegOpenKeyExA\n RegDeleteValueA\n GetTempFileNameA\n GetSystemInfo\n GetFileAttributesA\n LoadLibraryA\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryExA\n CreateDirectoryA\n DeleteFileA\n UnhandledExceptionFilter\n GetProcAddress\n GetStartupInfoW\n GetTempPathA\n CreateThread\n LockResource\n FindFirstFileA\n WriteFile\n FindNextFileA\n GetSystemDirectoryA\n GetModuleHandleW\n GetDriveTypeA\n TerminateProcess\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n FindResourceA\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleHandleExW\n LoadLibraryW\n FindNextFileW\n GetComputerNameExW\n CreateFileW\n GetCommandLineA\n CopyFileExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$53","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"si275471.exe\" claims program is from Wed Aug 26 14:35:54 2071","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/69 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"23/66 Antivirus vendors marked dropped file \"qu4639.exe\" as malicious (classified as \"RansomX\" with 34% detection rate)\n 18/69 Antivirus vendors marked dropped file \"un556351.exe\" as malicious (classified as \"malicious.moderate.ml\" with 26% detection rate)\n 21/57 Antivirus vendors marked dropped file \"pro1531.exe\" as malicious (classified as \"VHO:Backdoor.Mokes\" with 36% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"18/69 Antivirus vendors marked spawned process \"un556351.exe\" (PID: 7960) as malicious (classified as \"malicious.moderate.ml\" with 26% detection rate)\n 21/57 Antivirus vendors marked spawned process \"pro1531.exe\" (PID: 7684) as malicious (classified as \"VHO:Backdoor.Mokes\" with 36% detection rate)\n 23/66 Antivirus vendors marked spawned process \"qu4639.exe\" (PID: 2956) as malicious (classified as \"RansomX\" with 34% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"si275471.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003048)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":10,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\un556351.exe\" (Handle: 664)\n \".exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\si275471.exe\" (Handle: 124)\n \"un556351.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\pro1531.exe\" (Handle: 660)\n \"un556351.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\qu4639.exe\" (Handle: 656)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00003048.00000000.79401.00BC2000.00000002.mdmp\")\n \"ttps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00002956.00000000.78748.07290000.00000004.mdmp, 00000000-00002956.00000000.78748.08750000.00000004.mdmp, 00000000-00002956.00000000.78748.09D90000.00000004.mdmp, 00000000-00002956.00000000.78748.09E60000.00000004.mdmp\")\n \"ttps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00003048.00000000.79401.00BC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"193.233.20.33\": ...\n\n File SHA256: 982d077cf079f7302e20459ced5a22868b28f944d493489e0cf49339f808b2ee (Date: 03/26/2023 19:29:30)\n File SHA256: 5f664e3f4264a49f37857e2e65b39c7a064fa23a44516f88ff94e3abfc313878 (Date: 03/26/2023 19:32:35)\n File SHA256: 0a021d49e291f128a4bba40d680f2953f4ced978 (Date: 03/26/2023 19:29:46)\n File SHA256: bbd75286dcb546f16f55f46e580c35ca41086632d43f9f59595de265c9bf4db8 (Date: 03/26/2023 19:29:13)\n File SHA256: 36707241e173d5c8df90bf645c10724741b61322 (Date: 03/26/2023 19:33:44)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 193.233.20.33 on port 4125","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 00000000-00003048.00000000.79401.00BC2000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"si275471.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"si275471.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"si275471.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"si275471.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"si275471.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"si275471.exe\" trying to touch file \"%USERPROFILE%\\Documents\\MONERO\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$54","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$55","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"si275471.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"si275471.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"si275471.exe\" issued a query \"SELECT * FROM AntivirusProduct\"\n \"si275471.exe\" issued a query \"SELECT * FROM FirewallProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00006020-20579-5-012A1F90\n ExitWindowsEx@USER32.DLL at 00000000-00007960-23984-5-011E1F90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00006020)\n Spawned process \"un556351.exe\" (UID: 00000000-00007960)\n Spawned process \"pro1531.exe\" (UID: 00000000-00007684)\n Spawned process \"qu4639.exe\" (UID: 00000000-00002956)\n Spawned process \"si275471.exe\" (UID: 00000000-00003048)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Tries to steal desktop applications information (file access)"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Queries process information"},{"detail":"Reads the windows installation language"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":98,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer","ransomware","windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6420a0db566e44b4c90b5937","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["RUS"],"submit_name":"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.exe","analysis_start_time":"2023-03-26T19:45:32+00:00","indicators_count":{"informative":152,"suspicious":55,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.233.20.33","port":4125,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}],"processes":[{"pid":6020,"ppid":0,"name":"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.exe","command_line":"","sha256":"cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8","normalized_path":"C:\\cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8.exe","uid":"00000000-00006020","icon":"$56"},{"pid":7960,"ppid":6020,"name":"un556351.exe","command_line":"","sha256":"b5929fd60563c531feac6f7d1b0c2d3a785a44314f42c05d04114e90c8758ddd","normalized_path":"%TEMP%\\IXP000.TMP\\un556351.exe","parent_uid":"00000000-00006020","uid":"00000000-00007960"},{"pid":7684,"ppid":7960,"name":"pro1531.exe","command_line":"","sha256":"edd7d9ff54c6cade51fe11baeb6a0bb8b5c0691d384432580dbcc8c2070fa8ec","normalized_path":"%TEMP%\\IXP001.TMP\\pro1531.exe","parent_uid":"00000000-00007960","uid":"00000000-00007684"},{"pid":2956,"ppid":7960,"name":"qu4639.exe","command_line":"","sha256":"64837f678402c166260b80e0ef92bbc16f514f5f7509fc74158bd71d00a6a6f3","normalized_path":"%TEMP%\\IXP001.TMP\\qu4639.exe","parent_uid":"00000000-00007960","uid":"00000000-00002956"},{"pid":3048,"ppid":6020,"name":"si275471.exe","command_line":"","sha256":"a0e5fd5c7b772e2f9ab701bafbfe5d0bb3daaeb2071d5528b400b15f2b81e408","normalized_path":"%TEMP%\\IXP000.TMP\\si275471.exe","parent_uid":"00000000-00006020","uid":"00000000-00003048"}],"all_imported_dlls":["sechost.dll","comctl32.dll","mscoree.dll","ntmarta.dll","System.Core.ni.dll","KernelBase.dll","rpcrt4.dll","version.dll","fltLib.dll","WinTypes.dll","wbemcomn.dll","dpapi.dll","cfgmgr32.dll","setupapi.dll","ole32.dll","mscorlib.ni.dll","secur32.dll","apphelp.dll","AcLayers.dll","user32.dll","oleaut32.dll","wow64cpu.dll","ntdll.dll","gdi32.dll","imm32.dll","amsi.dll","userenv.dll","rsaenh.dll","System.Transactions.dll","msvcp_win.dll","vcruntime140_clr0400.dll","System.ni.dll","TextInputFramework.dll","CoreMessaging.dll","wbemprox.dll","webengine4.dll","shlwapi.dll","IPHLPAPI.DLL","sfc_os.dll","ws2_32.dll","mscoreei.dll","PresentationCore.ni.dll","PresentationNative_v0400.dll","fastprox.dll","SHCore.dll","kernel.appcore.dll","advpack.dll","cryptsp.dll","CoreUIComponents.dll","PresentationFramework.ni.dll","wbemsvc.dll","kernel32.dll","diasymreader.dll","msctf.dll","clbcatq.dll","aspnet_rc.dll","crypt32.dll","win32u.dll","msimg32.dll","msvcr100.dll","clr.dll","dwmapi.dll","System.Configuration.ni.dll","WMINet_Utils.dll","wow64.dll","msvcrt.dll","shell32.dll","sspicli.dll","cryptbase.dll","bcryptprimitives.dll","feclient.dll","wmiutils.dll","wow64win.dll","gdi32full.dll","ucrtbase.dll","advapi32.dll","cabinet.dll","psapi.dll","combase.dll","powrprof.dll","uxtheme.dll","clrjit.dll","profapi.dll","bcrypt.dll","ucrtbase_clr0400.dll","wintrust.dll","mswsock.dll","windows.storage.dll","wpfgfx_v0400.dll","System.Runtime.Serialization.ni.dll","System.Xml.ni.dll","winnlsres.dll","mpr.dll","wldp.dll","msasn1.dll","WindowsBase.ni.dll","DWrite.dll","msvcp140_clr0400.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"un556351.exe","sha256":"b5929fd60563c531feac6f7d1b0c2d3a785a44314f42c05d04114e90c8758ddd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"pro1531.exe","sha256":"edd7d9ff54c6cade51fe11baeb6a0bb8b5c0691d384432580dbcc8c2070fa8ec","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"qu4639.exe","sha256":"64837f678402c166260b80e0ef92bbc16f514f5f7509fc74158bd71d00a6a6f3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"pro1531.exe.log","sha256":"9ffa0a86729e45cfd8f7f3c46a114f4771baeb8fc7bef334d77b06bbfd0608ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"qu4639.exe.log","sha256":"9ffa0a86729e45cfd8f7f3c46a114f4771baeb8fc7bef334d77b06bbfd0608ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"si275471.exe.log","sha256":"7d5f882a5e261ef5b378c20ec6ac8670ddcbb7aa7882ce9c2452aea973eac7ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"si275471.exe","sha256":"a0e5fd5c7b772e2f9ab701bafbfe5d0bb3daaeb2071d5528b400b15f2b81e408","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\pro1531.exe.log","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\qu4639.exe.log","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\si275471.exe.log","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7684:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"Local\\SM0:2956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"Local\\SM0:3048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]},{"name":"SM0:3048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6420a0db566e44b4c90b5937"}]}]}},"report_ids":{"sandbox_job_ids":["6420a0db566e44b4c90b5937"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious HEUR/AGEN.1252166 Sample cb2a011220c6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cb2a011220c6…. Malware family: HEUR/AGEN.1252166. Threat score 100/100. 2/28 AV engines flagged this file. 18 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8"}],["$","meta","4",{"property":"og:title","content":"Malicious HEUR/AGEN.1252166 Sample cb2a011220c6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cb2a011220c6…. Malware family: HEUR/AGEN.1252166. Threat score 100/100. 2/28 AV engines flagged this file. 18 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious HEUR/AGEN.1252166 Sample cb2a011220c6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cb2a011220c6…. Malware family: HEUR/AGEN.1252166. Threat score 100/100. 2/28 AV engines flagged this file. 18 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L57","11",{}]]