24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Marsilia.Generic Sample cf67fa5786aa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cf67fa5786aa…. Malware family: Marsilia.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0","keywords":["Malicious","Marsilia.Generic","malware analysis","sandbox report","threat intelligence","cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Marsilia.Generic","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7be,".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007532) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007532) ".exe" called "RtlGetVersion" (UID: 00000000-00007532) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001f6f187d1f6f00000000d0a93e750000377590113875507eeb02f806e602a0e7ed02f8e9af00feffffffa0ecaf00506abd77cb82bc30feffffffb8eaaf00eaa9b977507eeb0200000000a0e7ed02a11400000a000b00b2971f6f5c761f6f68761f6fa0e7ed0270efed02140000000000000000000000507eeb02e0eaaf00cc2dbe77a0e7ed0200000000ace7ed0200000000f800186f00000000cc0d24385ce8bc776840bb77bc03000019000000110000001000000040bee50218ebaf008d9a4f74a0bce502a4f6ea020000000038ebaf001cbee502a4f6ea0250ebaf000000186ffeffffff0400000020af4f7400000000000000000000186f40ebaf00 (UID: 00000000-00007532)26:T889,".exe" queries volume information of "C:\cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.exe" at 00000000-00007532-00000C15-81860107 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007532-00000C15-82066477 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007532-00000C15-82326121 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007532-00000C15-84139531 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007532-00000C15-85008157 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007532-00000C15-85098331 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007532-00000C15-85098534 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007532-00000C15-85501589 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007532-00000C15-85524195 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007532-00000C15-85524413 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007532-00000C15-8619805727:T6ff,".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007532) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007532)28:T694,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007532) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007532)29:Tebe,Found reference to API (Indicator: "GetClassName"; File: "cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin") Found reference to API (Indicator: "GetObject"; File: "cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin") Found reference to API (Indicator: "GetLength"; File: "cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00007532.00000000.78459.04F20000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007532.00000000.78459.04F20000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00007532.00000000.78459.08240000.00000004.mdmp")2a:T5a1,".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MpOav.dll" - [base:0; Status:c0000049] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135]2b:T1cd0,".exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77B60000 ".exe" loaded module "C:\cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.exe" at 00420000 ".exe" loaded module "%WINDIR%\System32\ntdll.dll" at 867A0000 ".exe" loaded module "%WINDIR%\System32\wow64.dll" at 665E0000 ".exe" loaded module "%WINDIR%\System32\wow64win.dll" at 66640000 ".exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 665D0000 ".exe" loaded module "%WINDIR%\SysWOW64\mscoree.dll" at 72BF0000 ".exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 75250000 ".exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 75BF0000 ".exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 744D0000 ".exe" loaded module "%WINDIR%\apppatch\sysmain.sdb" at 7E010000 ".exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 75010000 ".exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 765E0000 ".exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 74960000 ".exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76480000 ".exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74580000 ".exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74570000 ".exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74900000 ".exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 75370000 ".exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 75DD0000 ".exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 766A0000 ".exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 747A0000 ".exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 76740000 ".exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 76360000 ".exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 75AC0000 ".exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 75ED0000 ".exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 745B0000 ".exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74470000 ".exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 007D0000 ".exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 749B0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 72B00000 ".exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 74FA0000 ".exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 75320000 ".exe" loaded module "C:\cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.exe" at 04D70000 ".exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 745A0000 ".exe" loaded module "%WINDIR%\SysWOW64\version.dll" at 74020000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 722E0000 ".exe" loaded module "%WINDIR%\SysWOW64\vcruntime140_clr0400.dll" at 722C0000 ".exe" loaded module "%WINDIR%\SysWOW64\ucrtbase_clr0400.dll" at 72210000 ".exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 07020000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 70E00000 ".exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 73DF0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 70D70000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 70310000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" at 6FAF0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" at 6F9E0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" at 6F260000 ".exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 76820000 ".exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 76320000 ".exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 76540000 ".exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 754F0000 ".exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 75E80000 ".exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 75BC0000 ".exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EE0000 ".exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 6F240000 ".exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 6F210000 ".exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" at 07630000 ".exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" at 6F180000 ".exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 73400000 ".exe" loaded module "%WINDIR%\System32\en-US\tzres.dll.mui" at 08000000 ".exe" loaded module "%WINDIR%\System32\en-US\tzres.dll.mui" at 07FF0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" at 08050000 ".exe" loaded module "%WINDIR%\SysWOW64\wldp.dll" at 6F160000 ".exe" loaded module "%WINDIR%\SysWOW64\crypt32.dll" at 74E10000 ".exe" loaded module "%WINDIR%\SysWOW64\msasn1.dll" at 765D0000 ".exe" loaded module "%WINDIR%\SysWOW64\wintrust.dll" at 751A0000 ".exe" loaded module "%WINDIR%\SysWOW64\amsi.dll" at 6F150000 ".exe" loaded module "%WINDIR%\SysWOW64\userenv.dll" at 6F120000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 6EDC0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 08740000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 6ED70000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 087A0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrcompression.dll" at 6ED50000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization.ni.dll" at 6EA70000 ".exe" loaded module "%WINDIR%\SysWOW64\psapi.dll" at 76730000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" at 6E9600002c:T1438,".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 745a0000 ".exe" loaded module "VERSION.DLL" at base 74020000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75bf0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75bf0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75bf0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 722e0000 ".exe" loaded module "USER32.DLL" at base 75370000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75bf0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 ".exe" loaded module "MSCOREE.DLL" at base 72bf0000 ".exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75ed0000 ".exe" loaded module "PSAPI.DLL" at base 76730000 ".exe" loaded module "KERNEL32.DLL" at base 75250000 ".exe" loaded module "RPCRT4.DLL" at base 76480000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70e00000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 ".exe" loaded module "OLE32.DLL" at base 75ac0000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73df0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 ".exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75ed0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70d70000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70310000 ".exe" loaded module "ADVAPI32.DLL" at base 75010000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 ".exe" loaded module "UXTHEME.DLL" at base 73df0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6faf0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f9e0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f260000 ".exe" loaded module "NTDLL.DLL" at base 77b60000 ".exe" loaded module "SHELL32.DLL" at base 76820000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 ".exe" loaded module "BCRYPT.DLL" at base 72ee0000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f210000 ".exe" loaded module "IMM32.DLL" at base 749b0000 ".exe" loaded module "COMCTL32.DLL" at base 6f180000 ".exe" loaded module "GDI32.DLL" at base 766a0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 ".exe" loaded module "WLDP.DLL" at base 6f160000 ".exe" loaded module "AMSI.DLL" at base 6f150000 ".exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 0 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6edc0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ed70000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRCOMPRESSION.DLL" at base 6ed50000 ".exe" loaded module "ADVAPI32" at base 75010000 ".exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74900000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 6ea70000 ".exe" loaded module "SSPICLI.DLL" at base 74580000 ".exe" loaded module "KERNEL32" at base 75250000 ".exe" loaded module "NTDLL" at base 77b60000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6e9600002d:T7ea,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL"2e:T765,".exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\CF67FA5786AAEF126E14D5A5EF53F55235D80F0CEDF4B42714CBF167F58C60C0.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CF67FA5786AAEF126E14D5A5EF53F55235D80F0CEDF4B42714CBF167F58C60C0.EXE.LOG" ".exe" trying to access non-existent file "C:\cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\FIRSTF" ".exe" trying to access non-existent file "C:\CF67FA5786AAEF126E14D5A5EF53F55235D80F0CEDF4B42714CBF167F58C60C0.INI" ".exe" trying to access non-existent file "C:\cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" ".exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING"2f:T12d6,Heuristic match: ". []().Ee" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://sentry-dsn.invalid" Pattern match: "http://james.newtonking.com/projects/json" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "Gt@.Gt" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "system.web/roleMan" Heuristic match: "ystem.Data.SQLite.SR" Pattern match: "urn.to/r/sds_see" Heuristic match: "~.B.Co" Heuristic match: "ZuI.CA" Heuristic match: "yxy.Pm"30:T73c,".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00007532) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007532) ".exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\FirstF\* (UID: 00000000-00007532) ".exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00007532) ".exe" called "FindNextFileW" with parameter 96f7edb07b12303f0ec2595c7f3778c7 (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00007532) ".exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00007532) ".exe" called "FindNextFileW" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\* (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\* (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\* (UID: 00000000-00007532) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\* (UID: 00000000-00007532)31:T4fb,Found string "" (Indicator: "GetDC"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "GetDC"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "GetWindowDC"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "CreateDC"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "CreateDC"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "BitBlt"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp") Found string "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007532.00000000.78459.02E50000.00000004.mdmp")32:Td3d,System.Dynamic.DynamicMetaObjectBinder::Bind(System.Dynamic.DynamicMetaObject,System.Dynamic.DynamicMetaObject[]) at 3d0703b52fc9d495dbaa88b4cfade77b-60008f0-~ System.Dynamic.GetIndexBinder::FallbackGetIndex(System.Dynamic.DynamicMetaObject,System.Dynamic.DynamicMetaObject[],System.Dynamic.DynamicMetaObject) at 3d0703b52fc9d495dbaa88b4cfade77b-60008e7-~ Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 3d0703b52fc9d495dbaa88b4cfade77b-6000af4-~ System.Dynamic.UnaryOperationBinder::FallbackUnaryOperation(System.Dynamic.DynamicMetaObject,System.Dynamic.DynamicMetaObject) at 3d0703b52fc9d495dbaa88b4cfade77b-60008e5-~ .::(System.Runtime.Serialization.SerializationBinder) at 3d0703b52fc9d495dbaa88b4cfade77b-6000e4a-~ Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 3d0703b52fc9d495dbaa88b4cfade77b-6000add-~ Microsoft.CSharp.RuntimeBinder.Binder::Convert(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.Type,System.Type) at 3d0703b52fc9d495dbaa88b4cfade77b-6000b72-SentryRequestFactoryc~ System.Type::GetProperty(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type,System.Type[],System.Reflection.ParameterModifier[]) at 3d0703b52fc9d495dbaa88b4cfade77b-6000da5-~ .::(System.Reflection.BindingFlags,System.Type) at 3d0703b52fc9d495dbaa88b4cfade77b-600072a-~ Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 3d0703b52fc9d495dbaa88b4cfade77b-6000b6b-SentryRequestFactory~ System.Dynamic.DynamicMetaObject::BindInvokeMember(System.Dynamic.InvokeMemberBinder,System.Dynamic.DynamicMetaObject[]) at 3d0703b52fc9d495dbaa88b4cfade77b-60008b9-~ Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at 3d0703b52fc9d495dbaa88b4cfade77b-6000d8c-~ System.Dynamic.DynamicMetaObject::BindBinaryOperation(System.Dynamic.BinaryOperationBinder,System.Dynamic.DynamicMetaObject) at 3d0703b52fc9d495dbaa88b4cfade77b-60008bc-~ System.Dynamic.DynamicMetaObject::BindSetIndex(System.Dynamic.SetIndexBinder,System.Dynamic.DynamicMetaObject[],System.Dynamic.DynamicMetaObject) at 3d0703b52fc9d495dbaa88b4cfade77b-60008bf-~ .<>::(System.String,System.Dynamic.DynamicMetaObjectBinder,System.Linq.Expressions.Expression[],System.Dynamic.DynamicMetaObject,./<>) at 3d0703b52fc9d495dbaa88b4cfade77b-60008c5-~ System.Dynamic.DynamicMetaObject::BindInvoke(System.Dynamic.InvokeBinder,System.Dynamic.DynamicMetaObject[]) at 3d0703b52fc9d495dbaa88b4cfade77b-60008bb-~ Microsoft.CSharp.RuntimeBinder.Binder::Convert(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.Type,System.Type) at 3d0703b52fc9d495dbaa88b4cfade77b-6000b88-~ System.Dynamic.DynamicMetaObjectBinder::Bind(System.Dynamic.DynamicMetaObject,System.Dynamic.DynamicMetaObject[]) at 3d0703b52fc9d495dbaa88b4cfade77b-60008ee-~ System.Type::GetMember(System.String,System.Reflection.BindingFlags) at 3d0703b52fc9d495dbaa88b4cfade77b-6000f1c-~ System.Runtime.CompilerServices.CallSite`1>::Create(System.Runtime.CompilerServices.CallSiteBinder) at 3d0703b52fc9d495dbaa88b4cfade77b-6000f30-~33:T5f1,".exe" wrote bytes "40d29674300d9774e0f69674c0cd9674" to virtual address "0x75A516C4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "d04f0976f0c2f37590c6fc7500cbf375f0f3fb7540ddfb7560effb75102df47580a6f37520befa757042fc75a0befa75c0fff37540bffa75e058fc75" to virtual address "0x75A515B0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "e03d44d3" to virtual address "0x722EF798" (part of module "CLR.DLL") ".exe" wrote bytes "10f2387500b93775f091be77109d387590923875c0b4387550883875d067387540b23875209c3875108c3875a0a43875507c387550a93875c0b33875805d3875c0e6387590753875c0ee3875a0c4387500c0387510d2377560aa3875" to virtual address "0x760E0228" (part of module "COMBASE.DLL") ".exe" wrote bytes "30ae9174" to virtual address "0x76531094" (part of module "RPCRT4.DLL") ".exe" wrote bytes "c0da5874c0db5874d07a5974" to virtual address "0x750810C0" (part of module "ADVAPI32.DLL") ".exe" wrote bytes "b07f5776d07f5776b0595b76" to virtual address "0x75A51778" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "10365a7420365a74" to virtual address "0x760E01A0" (part of module "COMBASE.DLL") ".exe" wrote bytes "d04c407370644073f0404073003f4073205d4073606b4073f0284173c03c4073" to virtual address "0x73E62078" (part of module "UXTHEME.DLL") ".exe" wrote bytes "e02a5774f0295774702a5774" to virtual address "0x6F23700C" (part of module "RSAENH.DLL")34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEREAAAAAAAAAAAAAAAAAkZmREQAAAAAAAAAAAAAAABGZmZkQAAABkREQAAAAAAARmZmZmQAAEZmRkAAAAAAAERmZmZmQERmZmZAAAAAAABEZmZmZmZEZmZmQAAAAAAABGZmZmZmZGZmZkAAAAAAAARGZmZmZmZmZmQAAAAAAAAERmZmZmZmZmZkAAAAAAAAAEZmZmZmZmZmZAABwAAAAABEZmZmZEZmZkAAAAAAAAAAxGZmZmRGZmZAAAAAAAAAAARmZmZEZmZkQAAAAAAAAAAERmZmRGZmeAAAAAAAAAAABEZmZkRmZmQAAAAAAAAAAABGZmZEZmZkAAAAAAAAAAAARGZmZmZmZAAAAAAAAAAAAGRmZmZmZkAAAAAAAAAAAAAEZmZmZmZcAAAAAAAAAAAABGZmZmZkAAAAHAAAAAAAAAZGZmZmZAAdXdwAAAAAAAAARmZmZmQd3d3cAAAAAAAAAEZmZmZl3d3d3AAAAAAAAAAkZmZmQBwd3dwAAAAAAAAAAAAAAAAB3d3cAAAAAAAAAAAAAAAAAB3d3AAAAAAAAAAAAAAAAAAAHdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////A////wAD//8AAB//AOAf/wDwH/+AEB//gAA//4AAP//AAD//wAAh/8AAQP/gIED/4ABA/+AAwP/wAMD/8ADA//AAwP/4AcD/+AEA//gAAP/8AAD//AIA//wDAP/+B4D////A////4P///+H////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791730079834,"unified_at":"2026-10-11T14:47:59.834Z","metadata":{"hashes":{"sha256":"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0","sha1":"d408b2a14dcfd74427c0cb2f62d642e8c7d338f5","md5":"3d0703b52fc9d495dbaa88b4cfade77b","sha512":"af7c72ddf4d245ae9f7400c7f171ab82220cf67b697f9ca70594d9923928ff60a8d5f5870b8e6fb43e8493ccac8affb1298df0a4a2e5ee65fe998b2703cff8dd","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"file.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2518016,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1681137958000,"last_seen":1681137958000,"last_multi_scan":1681137958000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":46},"sandbox_signatures":{"informative_count":77,"suspicious_count":15,"malicious_count":7,"total":99},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.33195","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.33195 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Scarsi.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXVS-DL!3D0703B52FC9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Marsilia.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"suspicious","value":"Contains ability to use cryptographic services (API string)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Loads the cryptographic module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user logon sessions (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (APIs)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found string \"FreeMemory\" (Indicator: \"FreeMemory\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n Found string \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found string \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007532.00000000.78459.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"??\\c:\\windows\\system32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007532.00000000.78459.02E50000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007532.00000000.78459.02E50000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found string \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007532.00000000.78459.04F20000.00000004.mdmp\")\n Found string \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007532.00000000.78459.04F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007532.00000000.78459.04F20000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007532.00000000.78459.04F20000.00000004.mdmp\")\n Found string \"ad certificate public key\" (Indicator: \"public key\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007532)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found string \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set JConstructor values with invalid key value: {0}. Argument position index expected.\" (Indicator: \"set \"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n Found string \"Set JObject values with invalid key value: {0}. Object property name expected.\" (Indicator: \"set \"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n Found string \"Set JArray values with invalid key value: {0}. Array position index expected.\" (Indicator: \"set \"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n Found string \"Set Defaults\" (Indicator: \"set \"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found string \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"systemInfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found string \"CreateProcessingInstruction\" (Indicator: \"CreateProcess\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n Found string \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Found string \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found string \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found string \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:7532:168:WilStaging_02\"\n \"SM0:7532:64:WilError_01\"\n \"SM0:7532:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$2b","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70E00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F150000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 722E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76480000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74900000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \".exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found string \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")\n Found string \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00007532.00000000.78459.08240000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found string \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00007532\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\".exe\" called \"GetComputerNameW\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\".exe\" called \"GetUserNameW\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Found string \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")\n Found string \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found string \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found string \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")\n Found string \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")\n Found string \"IoErr_GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about user logon sessions (API string)","description":"Found string \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found string \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found string \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007532.00000000.78459.02E50000.00000004.mdmp, 00000000-00007532.00000000.78459.04F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007532.00000000.78459.08240000.00000004.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007532.00000000.78459.08240000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"56/69 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"robert@blackcastlesoft.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00007532.00000000.78459.03670000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"System.Diagnostics.Trace::get_Listeners() at 3d0703b52fc9d495dbaa88b4cfade77b-600023f-~","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"28.1.2.0\"\n \"16.0.0.0\"\n Potential IP \"1.0.0.0\" found in string \"MyApplication.app,version=\"1.0.0.0\"C:\\cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.exe\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Data,4.0.0.0,,b77a5c561934e089\"\n \"0.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Culture=neutral\"\n Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Culture\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cultur\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"1.0.0.0\"\n \"1.0.116.0\"\n \"4.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007532.00000000.78459.073D0000.00000004.mdmp, 00000000-00007532.00000000.78459.075C0000.00000004.mdmp, 00000000-00007532.00000000.78459.08210000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00007532.00000000.78459.073D0000.00000004.mdmp, 00000000-00007532.00000000.78459.075C0000.00000004.mdmp, 00000000-00007532.00000000.78459.08210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"systemInfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00007532.00000000.78459.08240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetCurrentProcess\" (Source: cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"56/69 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"file.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002936)\n \"file.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found string \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00003804.00000000.66836.00400000.00000040.mdmp, 00000000-00003804.00000001.68756.00400000.00000040.mdmp, 00000000-00003804.00000002.70675.00400000.00000040.mdmp, 00000000-00003804.00000003.88985.00400000.00000040.mdmp\")\n Found string \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00003804.00000000.66836.00400000.00000040.mdmp, 00000000-00003804.00000001.68756.00400000.00000040.mdmp, 00000000-00003804.00000002.70675.00400000.00000040.mdmp, 00000000-00003804.00000003.88985.00400000.00000040.mdmp\")\n Found string \"GetActiveWindowTitle\" (Indicator: \"GetActiveWindowTitle\"; Source: \"00000000-00003804.00000000.66836.00400000.00000040.mdmp, 00000000-00003804.00000001.68756.00400000.00000040.mdmp, 00000000-00003804.00000002.70675.00400000.00000040.mdmp, 00000000-00003804.00000003.88985.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryW\" (UID: 00000000-00002936)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002936)\n \"file.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003804)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003804)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessA\" with parameter \"C:\\file.exe\" - (UID: 00000000-00002936)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\" (Indicator: \"mozilla/5.0 (\")\" in Source: 00000000-00003804.00000001.68756.02140000.00000004.mdmp, 00000000-00003804.00000002.70675.02140000.00000004.mdmp, 00000000-00003804.00000003.88985.02140000.00000004.mdmp, \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1\" (Indicator: \"mozilla/5.0 (\")\" in Source: 00000000-00003804.00000001.68756.02140000.00000004.mdmp, 00000000-00003804.00000002.70675.02140000.00000004.mdmp, 00000000-00003804.00000003.88985.02140000.00000004.mdmp, \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\" (Indicator: \"mozilla/5.0 (\")\" in Source: 00000000-00003804.00000001.68756.02140000.00000004.mdmp\n 00000000-00003804.00000002.70675.02140000.00000004.mdmp\n 00000000-00003804.00000003.88985.02140000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"100011000e03446d@ADVAPI32.dll\"\n \"150016002c8a976d@ADVAPI32.dll\"\n \"0e000f00a48a976d@ADVAPI32.dll\"\n \"0e000f00d88a976d@ADVAPI32.dll\"\n \"11001200388f976d@ADVAPI32.dll\"\n \"11001200a48f976d@ADVAPI32.dll\"\n \"12001300b88f976d@ADVAPI32.dll\"\n \"12001300e08f976d@ADVAPI32.dll\"\n \"1400150094a3976d@ADVAPI32.dll\"\n \"14001500aca3976d@ADVAPI32.dll\"\n \"14001500c4a3976d@ADVAPI32.dll\"\n \"0d000e0068a4976d@ADVAPI32.dll\"\n \"1b001c00381f866d@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"file.exe\" (UID: 00000000-00003804)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"file.exe\" (UID: 00000000-00003804)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"file.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll.config\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (APIs)","description":"Found api string \"socket\" (Indicator: \"socket\"; Source: \"00000000-00003804.00000001.68756.02140000.00000004.mdmp, 00000000-00003804.00000002.70675.02140000.00000004.mdmp, 00000000-00003804.00000003.88985.02140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003804\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE55726A780F4D4593B74F1410623C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002936.00000001.66541.003D0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE123F62793BC44E44BF2C51EA594E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003804.00000001.68756.00250000.00000004.mdmp, 00000000-00003804.00000002.70675.00250000.00000004.mdmp, 00000000-00003804.00000003.88985.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found string \",RtlGetNtProductType,NTDLL.d\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002936.00000001.66541.003D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"elect * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00003804.00000000.66836.00400000.00000040.mdmp, 00000000-00003804.00000001.68756.00400000.00000040.mdmp, 00000000-00003804.00000002.70675.00400000.00000040.mdmp, 00000000-00003804.00000003.88985.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found string \"CreateMutex\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003804.00000000.66836.00400000.00000040.mdmp, 00000000-00003804.00000001.68756.00400000.00000040.mdmp, 00000000-00003804.00000002.70675.00400000.00000040.mdmp, 00000000-00003804.00000003.88985.00400000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to use cryptographic services (API string)","description":"file/memory contains long string with (Indicator: \"Oid\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n file/memory contains long string with (Indicator: \"RC2\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"file.exe\" at 00000000-00002936-00000105-4497728\n \"file.exe\" at 00000000-00003804-00000105-4615254","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"file.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"file.exe\" called \"CreateProcessA\" with parameter \"C:\\file.exe\" - (UID: 00000000-00002936)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\"file.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\file.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"56/69 Antivirus vendors marked spawned process \"file.exe\" (PID: 3804) as malicious (classified as \"HEUR:Trojan.MSIL.Scarsi\" with 81% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 32 bytes to a remote process \"C:\\file.exe\" (Handle: 604)\n \"file.exe\" wrote 52 bytes to a remote process \"C:\\file.exe\" (Handle: 604)\n \"file.exe\" wrote 4 bytes to a remote process \"C:\\file.exe\" (Handle: 604)\n \"file.exe\" wrote 512 bytes to a remote process \"C:\\file.exe\" (Handle: 604)\n \"file.exe\" wrote 28672 bytes to a remote process \"C:\\file.exe\" (Handle: 604)\n \"file.exe\" wrote 1536 bytes to a remote process \"C:\\file.exe\" (Handle: 604)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility","evasive"],"sample_flags":["Multi-Process","Simulated analysis"],"sandbox_reports":[{"id":"6444cdd3890e290b73088f88","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HEUR:Trojan.MSIL.Scarsi","submit_name":"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0.exe","analysis_start_time":"2023-04-23T06:19:00+00:00","indicators_count":{"informative":59,"suspicious":22,"malicious":3},"is_in_unified_schema":true},{"id":"6443895ba9f40728bc05b303","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HEUR:Trojan.MSIL.Scarsi","submit_name":"file.exe","analysis_start_time":"2023-04-22T07:14:36+00:00","indicators_count":{"informative":67,"suspicious":26,"malicious":9},"tags":["Multi-Process","Simulated analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}],"processes":[{"pid":2936,"ppid":0,"name":"file.exe","command_line":"","sha256":"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0","normalized_path":"C:\\file.exe","uid":"00000000-00002936","icon":"$34"},{"pid":3804,"ppid":2936,"name":"file.exe","command_line":"","sha256":"cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0","normalized_path":"C:\\file.exe","parent_uid":"00000000-00002936","uid":"00000000-00003804"}],"all_imported_dlls":["wldp.dll","diasymreader.dll","ntdll.dll","kernel.appcore.dll","version.dll","bcrypt.dll","win32u.dll","msvcp_win.dll","ucrtbase.dll","combase.dll","windows.storage.dll","rsaenh.dll","ucrtbase_clr0400.dll","System.Configuration.ni.dll","powrprof.dll","msvcrt.dll","sechost.dll","wow64.dll","msasn1.dll","clrcompression.dll","apphelp.dll","System.ni.dll","psapi.dll","mscoree.dll","shell32.dll","amsi.dll","System.Data.dll","kernel32.dll","advapi32.dll","mscorlib.ni.dll","clrjit.dll","System.Xml.ni.dll","profapi.dll","crypt32.dll","wintrust.dll","mscorrc.dll","cryptbase.dll","comctl32.dll","userenv.dll","System.Transactions.dll","cryptsp.dll","imm32.dll","wow64cpu.dll","rpcrt4.dll","gdi32.dll","ole32.dll","vcruntime140_clr0400.dll","KernelBase.dll","cfgmgr32.dll","System.Runtime.Serialization.ni.dll","wow64win.dll","sspicli.dll","user32.dll","ws2_32.dll","shlwapi.dll","bcryptprimitives.dll","uxtheme.dll","SHCore.dll","dwmapi.dll","mscoreei.dll","gdi32full.dll","fltLib.dll","clr.dll","oleaut32.dll","System.Core.ni.dll","System.Data.ni.dll","System.Transactions.ni.dll","mswsock.dll","IPHLPAPI.DLL","dnsapi.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","Microsoft.VisualBasic.ni.dll","lpk.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","System.Drawing.ni.dll","usp10.dll","nlssorting.dll","winnsi.dll","api-ms-win-core-xstate-l2-1-0.dll","rasadhlp.dll","wship6.dll","RpcRtRemote.dll","System.Numerics.ni.dll","System.Windows.Forms.ni.dll","System.Windows.Forms.dll","rpcss.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"},{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"name":"SM0:7532:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"name":"SM0:7532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6444cdd3890e290b73088f88"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\vSLegcdVXA3W4jJx","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]},{"name":"vSLegcdVXA3W4jJx","sources":[{"report_type":"sandbox","report_id":"6443895ba9f40728bc05b303"}]}]}},"report_ids":{"sandbox_job_ids":["6444cdd3890e290b73088f88","6443895ba9f40728bc05b303"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Marsilia.Generic Sample cf67fa5786aa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cf67fa5786aa…. Malware family: Marsilia.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0"}],["$","meta","4",{"property":"og:title","content":"Malicious Marsilia.Generic Sample cf67fa5786aa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cf67fa5786aa…. Malware family: Marsilia.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cf67fa5786aaef126e14d5a5ef53f55235d80f0cedf4b42714cbf167f58c60c0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Marsilia.Generic Sample cf67fa5786aa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cf67fa5786aa…. Malware family: Marsilia.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]