24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T496,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/Generic Sample d3b08f5a5ac2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d3b08f5a5ac2…. Malware family: Trojan/Generic. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","keywords":["Malicious","Trojan/Generic","malware analysis","sandbox report","threat intelligence","d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639"],"about":{"@type":"SoftwareApplication","name":"Sipariş Hk,.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tafb,Found reference to API "__StaticArrayInitTypeSize=16" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=18" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "CreateDecryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=32" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "GetRuntimeFieldHandleFromMetadataToken" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Wow64SetThreadContext" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SetStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Security.Cryptography.CryptoConfig" (Indicator: "security"; Source: "sample.bin"), Found reference to API "FileAccess" (Indicator: "access"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=256" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "ResumeThread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "IAsyncStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "IAsyncStateMachine" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "AsyncTaskMethodBuilder`1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SetThreadContext" (Indicator: "read"; Source: "sample.bin"), Found reference to API "<>1__state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "ReadProcessMemory" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadToEndAsync" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadToEndAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "StreamReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Read" (Indicator: "read"; Source: "sample.bin"), Found reference to API "OpenProcess" (Indicator: "open"; Source: "sample.bin")26:T48c,Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAllocEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "sample.bin"), Found reference to API (Indicator: "WriteProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadContext"; Source: "sample.bin")27:T5da,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "sample.bin"), Found string "System.Security.Cryptography.CryptoConfig" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "5__4" (Indicator: "base64"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), Found string "CryptoStream" (Indicator: "cryptostream"; Source: "sample.bin")28:T406,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "sample.bin"), Found reference to "System.Security.Cryptography.CryptoConfig" (Indicator: "CryptoConfig"; Source: "sample.bin"), Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "sample.bin"), Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin")29:T424,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "Sipari Hk,.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "Sipari Hk,.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "Sipari Hk,.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp")2a:T4b9,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES Encryption Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions2b:T76c,"Sipari_Hk_.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009d000000000074019d0000000000060000000000000050019d001a0000000805a100000000001a0000001800010114000000932feb7378f4240045588a771fc33d00000000000200000248aca0005c2d00710805a1000100000000000000800000000005a1005c2d00710805a1000100000000000000020000000c000000e8a9a000e8a9a000e3a9a0000000000024f4240000009d000805a10168f3240030f4240088f9240045588a773fc33d00feffffff163486774134867794000000a0000000e2a9a000e0a9a000940000000cf52400b9142377b8130000b4f42400b8f42400 (UID: 00000000-00002704)2c:Tc4b,"Sipari_Hk_.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "QUERYADAPTERNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")2d:T1e4d,"Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter Sipari_Hk_.exe (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002704)2e:T54bb,"Sipari_Hk_.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00002704) "Sipari_Hk_.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002704)2f:T1486,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\Sy" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00002704.00000000.181664.02630000.00000004.mdmp 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\T" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00002704.00000001.183255.02630000.00000004.mdmp30:T8cf,"Sipari_Hk_.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "Sipari_Hk_.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]31:T1725,"Sipari_Hk_.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74d60000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Sipari_Hk_.exe" loaded module "KERNEL32" at base 77220000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Sipari_Hk_.exe" loaded module "ADVAPI32.DLL" at base 76c70000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73e00000 "Sipari_Hk_.exe" loaded module "SHLWAPI.DLL" at base 76f60000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Sipari_Hk_.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Sipari_Hk_.exe" loaded module "VERSION.DLL" at base 74e40000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72950000 "Sipari_Hk_.exe" loaded module "USER32.DLL" at base 77330000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Sipari_Hk_.exe" loaded module "MSCOREE.DLL" at base 74180000 "Sipari_Hk_.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Sipari_Hk_.exe" loaded module "PSAPI.DLL" at base 755f0000 "Sipari_Hk_.exe" loaded module "KERNEL32.DLL" at base 77220000 "Sipari_Hk_.exe" loaded module "RPCRT4.DLL" at base 754c0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71540000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Sipari_Hk_.exe" loaded module "OLE32.DLL" at base 76990000 "Sipari_Hk_.exe" loaded module "CRYPTBASE.DLL" at base 750c0000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73dc0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 73a30000 "Sipari_Hk_.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70ae0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 702c0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73da0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Sipari_Hk_.exe" loaded module "BCRYPT.DLL" at base 73d80000 "Sipari_Hk_.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 737a0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6fb40000 "Sipari_Hk_.exe" loaded module "NTDLL.DLL" at base 77830000 "Sipari_Hk_.exe" loaded module "SHELL32.DLL" at base 758a0000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75880000 "Sipari_Hk_.exe" loaded module "PROFAPI.DLL" at base 75600000 "Sipari_Hk_.exe" loaded module "CRYPTSP.DLL" at base 73d60000 "Sipari_Hk_.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 739f0000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "Sipari_Hk_.exe" loaded module "RASAPI32.DLL" at base 73740000 "Sipari_Hk_.exe" loaded module "RTUTILS.DLL" at base 73730000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75880000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75880000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "Sipari_Hk_.exe" loaded module "WS2_32.DLL" at base 76b80000 "Sipari_Hk_.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74210000 "Sipari_Hk_.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74200000 "Sipari_Hk_.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 73720000 "Sipari_Hk_.exe" loaded module "RASMAN.DLL" at base 73d40000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "Sipari_Hk_.exe" loaded module "WINHTTP.DLL" at base 736c0000 "Sipari_Hk_.exe" loaded module "SSPICLI.DLL" at base 750d0000 "Sipari_Hk_.exe" loaded module "CREDSSP.DLL" at base 73660000 "Sipari_Hk_.exe" loaded module "IPHLPAPI.DLL" at base 74780000 "Sipari_Hk_.exe" loaded module "DHCPCSVC6.DLL" at base 74270000 "Sipari_Hk_.exe" loaded module "DHCPCSVC.DLL" at base 74250000 "Sipari_Hk_.exe" loaded module "NSI.DLL" at base 77210000 "Sipari_Hk_.exe" loaded module "CFGMGR32.DLL" at base 752c0000 "Sipari_Hk_.exe" loaded module "OLEAUT32.DLL" at base 757d0000 "Sipari_Hk_.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75880000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "Sipari_Hk_.exe" loaded module "DNSAPI.DLL" at base 749b0000 "Sipari_Hk_.exe" loaded module "RASADHLP.DLL" at base 73650000 "Sipari_Hk_.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73610000 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "Sipari_Hk_.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 7350000032:T492,"0d000e0022031c7458f62400e9c5e973@ADVAPI32.dll" "0d000e00fe021c7444f52400e9c5e973@ADVAPI32.dll" "0b000c00cc021c74d8f82400e9c5e973@ADVAPI32.dll" "10001100da021c74dcef2400e9c5e973@ADVAPI32.dll" "150016003cdaec73ccf124002e02eb73@ADVAPI32.dll" "0e000f00ecdaec73ccf124002e02eb73@ADVAPI32.dll" "0e000f0048dbec73ccf124002e02eb73@ADVAPI32.dll" "1100120024e3ec73ccf124002e02eb73@ADVAPI32.dll" "11001200c0e3ec73ccf124002e02eb73@ADVAPI32.dll" "1200130004e4ec73ccf124002e02eb73@ADVAPI32.dll" "120013005ce4ec73ccf124002e02eb73@ADVAPI32.dll" "140015008005ed73ccf124002e02eb73@ADVAPI32.dll" "140015009805ed73ccf124002e02eb73@ADVAPI32.dll" "14001500b005ed73ccf124002e02eb73@ADVAPI32.dll" "17001800c805ed73ccf124002e02eb73@ADVAPI32.dll" "0d000e00e005ed73ccf124002e02eb73@ADVAPI32.dll" "0f0010000c07ed73ccf124002e02eb73@ADVAPI32.dll" "140015004c07ed73ccf124002e02eb73@ADVAPI32.dll" "140015006407ed73ccf124002e02eb73@ADVAPI32.dll" "0c000d00ac07ed73ccf124002e02eb73@ADVAPI32.dll" "0c000d00bc07ed73ccf124002e02eb73@ADVAPI32.dll" "0e000f00cc07ed73ccf124002e02eb73@ADVAPI32.dll" "180019003409ed73ccf124002e02eb73@RPCRT4.dll" "130014006009ed73ccf124002e02eb73@RPCRT4.dll"33:T48b,"Sipari Hk,.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:Tf9d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002704-00000C28-242836504] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002704-00000C25-1843655462] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002704-00000C25-1844399756] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002704-00000C25-1844476799] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002704-00000C25-1844605913] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002704-00000C25-1844647772] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002704-00000C25-1844778492] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002704-00000C25-1844867858] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002704-00000C25-1844997002] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002704-00000C25-1845040196] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002704-00000C25-1845076778] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002704-00000C25-1845658696] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002704-00000C25-1845703716] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002704-00000C25-1846392493] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00002704-00000C25-1846784749] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002704-00000C25-1847470178] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00002704-00000C25-1847979221] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002704-00000C25-1849739290] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002704-00000C25-1849840497] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00002704-00000C25-1850049592] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00002704-00000C25-1871515849] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002704-00000C25-1871822438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002704-00000C25-1871911196] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00002704-00000C25-1871970420] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00002704-00000C25-1872060889]35:T645,"Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PROPERTYBAG"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "Sipari_Hk_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: ""; Value: "")36:T1076,"Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME"; Key: "TZI"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME"; Key: "MUI_DISPLAY"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME"; Key: "MUI_STD"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME"; Key: "MUI_DLT"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "CATEGORY"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "NAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "PARENTFOLDER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "DESCRIPTION"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "RELATIVEPATH"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "PARSINGNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "INFOTIP"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "LOCALIZEDNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "ICON"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "SECURITY"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "STREAMRESOURCE"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "STREAMRESOURCETYPE"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "LOCALREDIRECTONLY"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "ROAMABLE"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "PRECREATE"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "STREAM"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "PUBLISHEXPANDEDPATH"; Value: "")37:T521,"Sipari_Hk_.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "Sipari_Hk_.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "Sipari_Hk_.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "Sipari_Hk_.exe" trying to touch file "C:\FLTLIB.DLL" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "Sipari_Hk_.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "Sipari_Hk_.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Sipari_Hk_.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "Sipari_Hk_.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"38:T5eb,"Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "Sipari_Hk_.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"39:Ta1d,Found URL "https://watersideeeerrrr.000webhostapp.com/kaywihttps://watersideeeerrrr.000webhostapp.com/kaywise.txtse.txtse.txthttps://watersideeeerrrr.000webhostapp.com/kaywise.txthttps://watersideeeerrrr.000webhostapp.com/kaywise.txtc4f16456-30f8-43af-82a4-e9cf80f0b933file:///c:/sipari_hk_.exefsdjhdure7536356file:///locationc:\sipari_hk_.exeswitch.system.globalization.noasynccurrentcultureswitch.system.globalization.enforcejapaneseerayearrangesswitch.system.globalization.formatjapanesefirstyearasanumberswitch.system.globalization.enforcelegacyjapanesedateparsingswitch.system.threading.throwexceptionifdisposedcancellationtokensourceswitch.system.diagnostics.eventsource.preserveeventlistnerobjectidentityswitch.system.io.uselegacypathhandlingswitch.system.io.blocklongpathsswitch.system.security.cryptography.donotaddrofcspparentwindowhandleswitch.system.security.claimsidentity.setactorasreferencewhencopyingclaimsidentityswitch.system.diagnostics.ignoreportablepdbsinstacktracesswitch.system.runtime.serialization.usenewmaxarraysizeswitch.system.threading.uselegacyexecutioncontextbehavioruponundofailureswitch.system.security.cryptography.uselegacyfipsthrowswitch.system.runtime.interopservices.donotmarshaloutbyrefsafearrayoninvokeswitch.system.threading.usenetcoretimertestswitch.localappcontext.disablecaching.netframeworkversionprofile.netframeworkversion=v4.5.1versionv4.5.14.5.1inputversionbuildrevision.netcorewindowsphonewindowsphoneappsoftware\microsoft\.netframework\appcontext" - Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp") Found URL "https://watersideeeerrrr.000webhostapp.com/kaywise.txtwebrequestcreatemaxdatasizetracemodesystem.netsystem.net.httplistenersystem.net.socketssystem.net.websocketssystem.net.cachesystem.net.httpsystem.configuration.internal.configurationmanagerinternal," - Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\sipari_hk_.exe.configfile:///c:/sipari_hk_.exec:/sipari_hk_.exec:\sipari_hk_.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp") Found URL "https://watersideeeerrrr.000webhostapp.com/kaywise.txtintel(r)" - Source: "00000000-00002704.00000001.183255.009D0000.00000004.mdmp")3a:T99c,"Sipari_Hk_.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002704) "Sipari_Hk_.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002704)3b:T65a,Found string "passwordAttem" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.009D0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.009D0000.00000004.mdmp, 00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.009D0000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.009D0000.00000004.mdmp, 00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.009D0000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.009D0000.00000004.mdmp, 00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.009D0000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp")3c:Te5a,"Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTRATIONENABLED"; Value: "") "Sipari_Hk_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEDYNAMICUPDATE"; Value: "")3d:T700,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Sipari Hk,.exe") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "Sipari Hk,.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "Sipari Hk,.exe") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "Sipari Hk,.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "Sipari Hk,.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp")3e:T53b,Found string "ResumeThread" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "Wow64SetThreadContext" (Source: Sipari Hk,.exe, API is part of module: KERNEL32.DLL) Found string "SetThreadContext" (Source: Sipari Hk,.exe, API is part of module: KERNEL32.DLL) Found string "Wow64GetThreadContext" (Source: Sipari Hk,.exe, API is part of module: KERNEL32.DLL) Found string "GetThreadContext" (Source: Sipari Hk,.exe, API is part of module: KERNEL32.DLL) Found string "VirtualAllocEx" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "WriteProcessMemory" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "ReadProcessMemory" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "ZwUnmapViewOfSection" (Source: Sipari Hk,.exe, API is part of module: NTDLL.DLL) Found string "CreateProcessA" (Source: Sipari Hk,.exe, API is part of module: KERNEL32.DLL) Found string "GetCurrentProcess" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualProtect" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "OpenProcess" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: Sipari Hk,.exe, API is part of module: KERNELBASE.DLL)3f:T8ae,"d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")40:T501,"d3b08.Spy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "d3b08.Spy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")41:T8db,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp")42:T9e2,"d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "d3b08.Spy.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")43:T8f3,"d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F1\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "d3b08.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\D3B08_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")44:T443,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp")45:T44e,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp")46:T11a8,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003544.00000000.79850.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003544.00000000.79850.01F80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\Sy" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\T" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00003544.00000001.80748.01F80000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004308.00000001.81091.00701000.00000020.mdmp47:Tf85,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003544-00000C2B-253100735] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003544-00000C2B-253467481] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003544-00000C2B-254940307] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003544-00000C2B-255118780] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003544-00000C2B-255396427] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003544-00000C2B-255468853] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003544-00000C2B-255685366] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003544-00000C2B-255775031] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003544-00000C2B-255936351] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003544-00000C2B-256007841] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003544-00000C2B-256077347] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003544-00000C2B-256315798] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003544-00000C2B-256395662] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003544-00000C2B-257176231] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00003544-00000C2B-257547077] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00003544-00000C2B-257770659] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00003544-00000C2B-258451492] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003544-00000C2B-260515738] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003544-00000C2B-260708109] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00003544-00000C2B-261095820] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003544-00000C2B-269391243] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003544-00000C2B-270037753] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003544-00000C2B-270158875] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003544-00000C2B-270256737] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00003544-00000C2B-270370782]48:Teac,"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003544) "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003544)49:Tf11,Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "CopySid" (Indicator: "CopySid"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "AddAce" (Indicator: "AddAce"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00004308.00000001.81091.00701000.00000020.mdmp")4a:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6AA64B1B.bin]4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIiIiAAACI////////////////gAAAj/////////////////AAAP/////////////////wAAD/////////////////8AAA//////////////////AAAP/////////////////wAAD/////////////////8AAA//////////////////AAAP/////////////////wAAD/////////////////8AAA//////////////////AAAP/////////////////wAAD/////////////////8AAA//////////////////AAAP/////////////////wAAD/////////////////8AAA//////////////////AAAP/////////////////wAACP////////////////93d3eIiIiIiIiIiIj/////eIiIiIiIiIiIiIiIj////4iIiIiI/4iIj/iIiI////+IiPiIj4j4iPiPiIiP////iIj4iIiIiIj4iIiIj////4iI+IiPiIiI+I+IiI+IiIiIiIiIiP+IiI/4iIiId2ZniIiIiIiIiIiIiIiIiHdmYIiIiIiIiIiIiIiIiPh3ZgAAAAj////////////4d2AAAAAP////////////+HcAAAAAAP////////////hwAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAA/gAAAf4AAAP/AAAHw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791324485226,"unified_at":"2026-10-06T22:08:05.226Z","metadata":{"hashes":{"sha256":"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","sha1":"5e72f67a00d3146a7153613c4320aa78a91a4c7f","md5":"bc4ea0de831e420a531c7cebd18ab131","sha512":"4ea2175a75c1b76929735b2e3ce639ef6f016e94f1b7e38c61518183d751c7aa771a89b86353fea40a97407e1172b8701ff13d744084478f7b1bf4af2f4c2897","ssdeep":"3072:9r9IGyFzvYZ+zj3FG+9wqY+mhhhmitqOv:rGjYZSQKi","ssdeep_chunks":["3072:9r9IGyF","3072:r9IGyFz","3072:9IGyFzv","3072:IGyFzvY","3072:GyFzvYZ","3072:yFzvYZ+","3072:FzvYZ+z","3072:zvYZ+zj","3072:vYZ+zj3","3072:YZ+zj3F","3072:Z+zj3FG","3072:+zj3FG+","3072:zj3FG+9","3072:j3FG+9w","3072:3FG+9wq","3072:FG+9wqY","3072:G+9wqY+","3072:+9wqY+m","3072:9wqY+mh","3072:wqY+mhh","3072:qY+mhhh","3072:Y+mhhhm","3072:+mhhhmi","3072:mhhhmit","3072:hhhmitq","3072:hhmitqO","3072:hmitqOv","6144:9r9IGyF","6144:r9IGyFz","6144:9IGyFzv","6144:IGyFzvY","6144:GyFzvYZ","6144:yFzvYZ+","6144:FzvYZ+z","6144:zvYZ+zj","6144:vYZ+zj3","6144:YZ+zj3F","6144:Z+zj3FG","6144:+zj3FG+","6144:zj3FG+9","6144:j3FG+9w","6144:3FG+9wq","6144:FG+9wqY","6144:G+9wqY+","6144:+9wqY+m","6144:9wqY+mh","6144:wqY+mhh","6144:qY+mhhh","6144:Y+mhhhm","6144:+mhhhmi","6144:mhhhmit","6144:hhhmitq","6144:hhmitqO","6144:hmitqOv","3072:rGjYZSQ","3072:GjYZSQK","3072:jYZSQKi"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Sipariş Hk,.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":236032,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1719305792000,"last_seen":1789275871000,"last_multi_scan":1789275871000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":173,"suspicious_count":20,"malicious_count":6,"total":199},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.DarkCloud","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.621468","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Darkcloud-10032507-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.621468 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Injector.NMP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"UDS:TrojanPSW.MSIL.DarkCloud.gen.fdhs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!9236D56A7E5F0E90","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d9e331 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_create_HTTP_request","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.Win32.1839129","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Able to perform cryptographic operations"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"FSDJHDURE7536356.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$27","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Able to perform cryptographic operations","description":"Found strings that indicate potentially cryptographic operations: computehash, md5cryptoserviceprovider, createdecryptor, cryptography, rijndaelmanaged, createencryptor","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-962","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.CryptoConfig.AesCryptoServiceProvider.CreateDecryptor\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\"), Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.012","id":"string-90","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"pmr5.ju/uh/j4`1[[system.object\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"Sipari Hk,.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"Sipari Hk,.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"Sipari Hk,.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetHINSTANCE\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"Sipari Hk,.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002704.00000000.181664.03630000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002704.00000001.183255.03630000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"Sipari Hk,.exe\"\n Observed function \"ToBase64String\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"Sipari Hk,.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002704.00000000.181664.009D0000.00000004.mdmp, 00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.TripleDES\" and TypeReference \"Create\" in \"Sipari Hk,.exe\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"Sipari Hk,.exe\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Sipari_Hk_.exe\" called \"IsWow64Process\" with parameter \"2704\" - (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Sipari_Hk_.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Sipari_Hk_.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000640044006100740061000000130000132c210000e8f0a00048aca00038005c0053006300720069007000740073005c003b0043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c00080000085a21000048aca000 (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Sipari_Hk_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Sipari_Hk_.exe\" queries volume information of \"C:\\Sipari_Hk_.exe\" at 00000000-00002704-00000046-1745343","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Sipari_Hk_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)\" (SID: 2026657, Rev: 4, Severity: 3) categorized as \"Not Suspicious Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Sipari_Hk_.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002704)\n \"Sipari_Hk_.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"145.14.145.84:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Sipari Hk,.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002704.00000000.181664.00872000.00000020.mdmp, 00000000-00002704.00000000.181664.03630000.00000004.mdmp, 00000000-00002704.00000001.183255.03630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"VirtualAllocEx\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Sipari Hk,.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"ResumeThread\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"Wow64SetThreadContext\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"SetThreadContext\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"Wow64GetThreadContext\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"GetThreadContext\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"VirtualAllocEx\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"WriteProcessMemory\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"ReadProcessMemory\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"ZwUnmapViewOfSection\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"CreateProcessA\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"VirtualProtect\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"OpenProcess\" in \"Sipari Hk,.exe\"\n Observed unmanaged function \"CloseHandle\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Sipari_Hk_.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71540000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Sipari_Hk_.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73D80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Sipari_Hk_.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73100000\n \"Sipari_Hk_.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72950000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Sipari_Hk_.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Sipari Hk,.exe\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"Sipari Hk,.exe\" was detected as \".NET\" and name: \"Library\"\n \"Sipari Hk,.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Sipari_Hk_.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Sipari Hk,.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Sipari Hk,.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Sipari Hk,.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Sipari Hk,.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"watersideeeerrrr.000webhostapp.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Sipari Hk,.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Sipari_Hk_.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Sipari_Hk_.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rsaenh.dll\" (UID: 2704)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Sipari_Hk_.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"Sipari_Hk_.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"Sipari_Hk_.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\0b2f69b43a576b9edcc807a30872bd91\\system.ni.dll.aux\"\n \"Sipari_Hk_.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"Sipari_Hk_.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"Sipari_Hk_.exe\" reads file \"c:\\sipari_hk_.exe\"\n \"Sipari_Hk_.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"\n \"Sipari_Hk_.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.pdb\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\System.pdb\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\mscorlib.pdb\"\n \"Sipari_Hk_.exe\" touched file \"C:\\Windows\\FSDJHDURE7536356.pdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Sipari_Hk_.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.local\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"C:\\Sipari_Hk_.exe.config\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.localgac\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\FSDJHDURE7536356\\\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"C:\\Sipari_Hk_.INI\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{A3C5A950-CBBD-4EFA-9430-4E8BB4184281}\"\n \"Sipari_Hk_.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002704-00000C26-1847570369\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002704-00000C26-1848097538\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002704-00000C26-1848097998\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /kaywise.txt HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002704.00000001.183255.02630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"145.14.145.84\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00002704\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Sipari_Hk_.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Sipari_Hk_.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"Sipari Hk,.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Sipari_Hk_.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\SysWOW64\\rsaenh.dll\" (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002704.00000000.181664.009D0000.00000004.mdmp, 00000000-00002704.00000001.183255.009D0000.00000004.mdmp\")\n Found string \"\\Device\\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002704.00000001.183255.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002704.00000000.181664.02630000.00000004.mdmp, 00000000-00002704.00000001.183255.02630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Sipari_Hk_.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Sipari_Hk_.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Sipari Hk,.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Sipari_Hk_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"Sipari_Hk_.exe\" at 00000000-00002704-00000033-3359160","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Sipari_Hk_.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2704)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"Sipari_Hk_.exe queries ProcessDebugPort (UID: 2704)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Sipari Hk,.exe\" has resource with unusual entropy \"RT_ICON:7.84715025286\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 145.14.145.84 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Sipari Hk,.exe\" claims program is from Sat Dec 7 19:40:47 2052","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=RapidSSL TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: B0:57:03:97:AE:15:06:79:FC:86:0E:E2:79:B6:B0:9D:37:04:A5:49; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: CB:FE:9E:B4:3B:3B:37:FE:0D:FB:C4:C2:EB:2D:4E:07:D0:8B:D8:E8; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"d3b08.Spy.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /kaywise.txt HTTP/1.1Host: watersideeeerrrr.000webhostapp.com\n Connection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://watersideeeerrrr.000webhostapp.com/kaywise.txt","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLED96696F31AB145AFFE558506F075]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008676.00000000.86831.03430000.00000004.mdmp, 00000000-00008676.00000001.88753.03430000.00000004.mdmp, 00000000-00008676.00000002.90671.03430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"d3b08.Spy.exe\" called \"GetComputerNameW\" (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00008676.00000001.88753.08AB0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetHINSTANCE\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"\n Observed function \"ToBase64String\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003544.00000000.79850.003F0000.00000004.mdmp, 00000000-00003544.00000001.80748.003F0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004308.00000000.80498.00200000.00000004.mdmp, 00000000-00004308.00000001.81091.00253000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"DISMHOST.EXE.6AA64B1B.bin\" at offset 76665; code bytes = 30d0\n Found XOR loop in file \"DISMHOST.EXE.6AA64B1B.bin\" at offset 77648; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6AA64B1B.bin\" at offset 77788; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6AA64B1B.bin\" at offset 78978; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 65991; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003544-00000C2C-256537638\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003544-00000C2C-256537638\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6AA64B1B.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003544-00000C2C-255116964\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003544-00000C2C-255117726\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003544-00000C2C-261334871\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003544)\n \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003544)\n \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003544)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"VirtualAllocEx\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6AA64B1B.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6AA64B1B.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: 00000000-00003544]\n \"DISMHOST.EXE.6AA64B1B.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00003544]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebResponse.GetResponseStream\" in \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003544-00000C2C-257971697\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003544-00000C2C-257957543\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003544.00000000.79850.01380000.00000002.mdmp\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately.\" (Indicator: \" socket \"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately\" (Indicator: \" socket \"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003544\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003544.00000001.80748.003F0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003544.00000001.80748.003F0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003544.00000001.80748.003F0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003544.00000001.80748.003F0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004308.00000000.80498.00200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003544.00000001.80748.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00003544.00000000.79850.02F80000.00000004.mdmp, 00000000-00003544.00000001.80748.01342000.00000020.mdmp, 00000000-00003544.00000001.80748.02F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004308.00000001.81091.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4a","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00004308.00000000.80498.00200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6AA64B1B.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00003544]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\rsaenh.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n RegOpenKeyExW\n RegCloseKey\n UnhandledExceptionFilter\n GetModuleHandleExW\n GetModuleHandleW\n CreateThread\n Sleep\n GetCommandLineW\n GetTickCount\n GetSystemDirectoryW\n OutputDebugStringW\n LoadLibraryExW\n GetVersionExW\n GetStartupInfoA\n OutputDebugStringA\n MapViewOfFile\n GetProcAddress\n CreateFileW\n GetVersionExA\n GetModuleHandleA\n LoadLibraryW\n FindResourceExW\n CreateFileMappingW\n GetFileAttributesW\n GetModuleFileNameW\n TerminateProcess","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"0000000000\")\n \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"0000000000\")\n \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF00\")\n \"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}],"intel_graph":{"map":{"Domain:watersideeeerrrr.000webhostapp.com":{"type":"Domain","value":"watersideeeerrrr.000webhostapp.com"},"File:823a315bb42588a66750ce3bdc169a553b13943ae2eb36f5f7b17ee50ec119a2":{"type":"File","value":"823a315bb42588a66750ce3bdc169a553b13943ae2eb36f5f7b17ee50ec119a2"},"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639":{"type":"File","value":"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Ip:145.14.144.230":{"type":"Ip","value":"145.14.144.230"},"Ip:145.14.145.84":{"type":"Ip","value":"145.14.145.84"}},"chains":[{"id":"sandbox_network","root":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","edges":[{"edge_kind":"contacted_ip","from_key":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","to_key":"Ip:145.14.145.84"},{"edge_kind":"contacted_ip","from_key":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","to_key":"Ip:145.14.144.230"},{"edge_kind":"contacted_domain","from_key":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","to_key":"Domain:watersideeeerrrr.000webhostapp.com"},{"edge_kind":"resolves_to","from_key":"Domain:watersideeeerrrr.000webhostapp.com","to_key":"Ip:145.14.145.84"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","edges":[{"edge_kind":"extracted","from_key":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","to_key":"File:823a315bb42588a66750ce3bdc169a553b13943ae2eb36f5f7b17ee50ec119a2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":47,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":47,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aa62ede8f275cc15d0e2d19","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:TrojanPSW.MSIL.DarkCloud.gen","submit_name":"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","analysis_start_time":"2026-09-13T05:04:31+00:00","indicators_count":{"informative":143,"suspicious":17,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"667c4ce9966bbcb9a300bf03","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD"],"submit_name":"d3b08. Spy.exe","analysis_start_time":"2024-06-26T17:16:26+00:00","indicators_count":{"informative":106,"suspicious":21,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"667a86409d9c2c6fbf0e2e06","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD"],"submit_name":"Sipariş Hk,.exe","analysis_start_time":"2024-06-25T08:56:33+00:00","indicators_count":{"informative":97,"suspicious":18,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"145.14.145.84","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"address":"145.14.144.230","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]}],"dns_resolutions":[{"domain":"watersideeeerrrr.000webhostapp.com","address":"145.14.145.84","ttl":3600,"country":"Netherlands","registrar_name":"Hostinger, UAB","registrar_organization":"Hostinger International Limited","registrar_name_servers":"DNS1.000WEBHOST.COM","registrar_creation_date":"2016-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}],"processes":[{"pid":2704,"ppid":0,"name":"Sipari_Hk_.exe","command_line":"","sha256":"d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639","normalized_path":"C:\\Sipari_Hk_.exe","uid":"00000000-00002704","icon":"$4b"}],"all_imported_dlls":["version.dll","wow64.dll","mscorlib.ni.dll","wship6.dll","dnsapi.dll","diasymreader.dll","mscoree.dll","cryptbase.dll","fltLib.dll","bcrypt.dll","kernel32.dll","KernelBase.dll","msvcrt.dll","cryptsp.dll","psapi.dll","mswsock.dll","dhcpcsvc.dll","ucrtbase_clr0400.dll","rasapi32.dll","advapi32.dll","gdi32.dll","ole32.dll","oleaut32.dll","rtutils.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","wow64win.dll","msctf.dll","ws2_32.dll","nsi.dll","ntdll.dll","IPHLPAPI.DLL","rasadhlp.dll","rpcrt4.dll","VxSSL32.dll","shlwapi.dll","winnsi.dll","cfgmgr32.dll","mscoreei.dll","sechost.dll","lpk.dll","api-ms-win-core-synch-l1-2-0.dll","System.ni.dll","nlssorting.dll","mscorrc.dll","clrjit.dll","System.Core.ni.dll","vcruntime140_clr0400.dll","WSHTCPIP.DLL","webio.dll","imm32.dll","rasman.dll","clr.dll","System.Configuration.ni.dll","shell32.dll","rsaenh.dll","credssp.dll","user32.dll","sspicli.dll","usp10.dll","winhttp.dll","wow64cpu.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Xml.ni.dll","profapi.dll","ntasn1.dll","schannel.dll","SHCore.dll","secur32.dll","msasn1.dll","powrprof.dll","ucrtbase.dll","ncryptsslp.dll","apphelp.dll","bcryptprimitives.dll","win32u.dll","gdi32full.dll","mskeyprotect.dll","ncrypt.dll","msvcp_win.dll","combase.dll","kernel.appcore.dll","crypt32.dll","gpapi.dll","clbcatq.dll","windows.storage.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","vcruntime140.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","msvcp140.dll","rpcss.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DISMHOST.EXE.6AA64B1B.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"name":"dism.log","sha256":"823a315bb42588a66750ce3bdc169a553b13943ae2eb36f5f7b17ee50ec119a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{A3C5A950-CBBD-4EFA-9430-4E8BB4184281}","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"},{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"667a86409d9c2c6fbf0e2e06"}]},{"name":"Local\\SM0:8676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"name":"SM0:8676:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"name":"SM0:8676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"667c4ce9966bbcb9a300bf03"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa62ede8f275cc15d0e2d19"}]}]}},"report_ids":{"sandbox_job_ids":["6aa62ede8f275cc15d0e2d19","667c4ce9966bbcb9a300bf03","667a86409d9c2c6fbf0e2e06"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan/Generic Sample d3b08f5a5ac2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d3b08f5a5ac2…. Malware family: Trojan/Generic. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/Generic Sample d3b08f5a5ac2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d3b08f5a5ac2…. Malware family: Trojan/Generic. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d3b08f5a5ac2dd9136da86cf6baea1179e5998f153cd1f29284ae2ba4c337639"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/Generic Sample d3b08f5a5ac2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d3b08f5a5ac2…. Malware family: Trojan/Generic. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]